CVE-2026 list

CVE-2026 records published in April 2026

Page two of six: records 1,001 to 2,000 of the 5,323 published in April 2026, newest first. The first page carries the figures for April 2026.

CVE-2026 records published in April 2026, newest first: records 1,001 to 2,000 of 5,323
CVE Summary CVSS EPSS Published Signals
CVE-2026-25660Ericsson CodeChecker authentication bypass for certain API calls9.3CNA v4.00.6%2026-04-24Fix
CVE-2026-23902Apache DolphinScheduler has an incorrect authorization8.1CISA ADP v3.10.4%2026-04-24Fix
CVE-2026-21728Tempo query limit results in unbounded memory allocation7.5CNA v3.10.6%2026-04-24Fix
CVE-2026-21515Microsoft Azure IoT Central elevation of privilege9.9CNA v3.10.7%2026-04-24Fix
CVE-2026-6968Multiple path traversal Variants in awslabs/tough7.1CNA v4.00.5%2026-04-24Fix
CVE-2026-6967Missing Delegated Metadata Validation in awslabs/tough7.1CNA v4.00.3%2026-04-24Fix
CVE-2026-6966Signature Threshold Bypass in awslabs/tough Delegated Roles7.0CNA v4.00.3%2026-04-24Fix
CVE-2026-6947D-Link｜DWM-222W USB Wi-Fi Adapter brute-force Protection Bypass8.7CNA v4.00.5%2026-04-24Fix
CVE-2026-6912Privilege escalation via Self-Writable Cognito Custom attribute in AWS Ops Wheel8.7CNA v4.01.0%2026-04-24Fix
CVE-2026-6911Authentication bypass via Missing JWT signature verification in AWS Ops Wheel9.3CNA v4.00.4%2026-04-24Fix
CVE-2026-6810Booking Calendar Contact Form WordPress plugin insecure direct object reference to Calendar takeover5.3CNA v3.10.4%2026-04-24Fix
CVE-2026-6393BetterDocs WordPress plugin missing authorization authenticated unauthorized AI API Usage4.3CNA v3.10.4%2026-04-24Fix
CVE-2026-6272Eclipse KUKSA missing authentication8.5CNA v4.00.4%2026-04-24
CVE-2026-6043Perforce Helix Core Server (P4D) insecure default Configuration in P4 Server8.8CNA v4.01.3%2026-04-24Exploit code
CVE-2026-5488ExactMetrics WordPress plugin missing authorization Google Ads access Token Retrieval5.3CNA v3.10.5%2026-04-24Fix
CVE-2026-5428Royal Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-24Fix
CVE-2026-5367Red Hat Fast Datapath for Red Hat Enterprise Linux 10 ovn: Ovn: Information disclosure8.6CNA v3.10.9%2026-04-24Fix
CVE-2026-5364Drag and Drop File Upload for Contact Form 7 WordPress plugin unauthenticated arbitrary file upload8.1CNA v3.11.1%2026-04-24Exploit codeFix
CVE-2026-5347WP Books Gallery WordPress plugin missing authorization unauthenticated settings update5.3CNA v3.10.4%2026-04-24Fix
CVE-2026-5265Red Hat OVN ICMP error response generation vulnerability6.5CNA v3.10.7%2026-04-24Fix
CVE-2026-4313Stored XSS in AdaptiveGRC2.4CNA v4.00.7%2026-04-24Fix
CVE-2026-4078ITERAS WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-24Fix
CVE-2026-3569Liaison Site Prober WordPress plugin information disclosure5.3CNA v3.10.5%2026-04-24Fix
CVE-2026-3565Taqnix WordPress plugin cross-site request forgery to account deletion4.3CNA v3.10.2%2026-04-24Fix
CVE-2026-2028MaxiBlocks Builder WordPress plugin file deletion5.3CNA v3.10.3%2026-04-24Fix
CVE-2026-1952Denial of service via the undocumented subfunction in AS320T9.8CNA v3.10.3%2026-04-24Fix
CVE-2026-1951No checking of the length of the buffer with the directory name in AS320T9.8CNA v3.10.6%2026-04-24Fix
CVE-2026-1950No checking of the length of the buffer with the file name in AS320T9.8CNA v3.10.3%2026-04-24Fix
CVE-2026-1949Incorrect calculation of buffer size on the stack in AS320T9.8CNA v3.10.6%2026-04-24Fix
CVE-2026-1789Canon imagePRESS Series reliance on untrusted input in a security decision6.9CNA v4.00.3%2026-04-24Fix
CVE-2026-41990GnuPG Libgcrypt out-of-bounds write4.0CNA v3.10.2%2026-04-23Fix
CVE-2026-41989GnuPG Libgcrypt out-of-bounds write6.7CNA v3.10.2%2026-04-23Fix
CVE-2026-41988uuidjs uuid incorrect control flow2.5v3.10.2%2026-04-23Fix
CVE-2026-41909OpenClaw improper authorization in Paired-Device Pairing Actions5.3CNA v4.00.3%2026-04-23Fix
CVE-2026-41908OpenClaw Scope Enforcement Bypass in Assistant-Media route6.5v3.10.4%2026-04-23Fix
CVE-2026-41679Paperclip vulnerable to unauthenticated remote code execution via import authorization bypass10.0CNA v3.17.4%2026-04-23Reported exploitedNucleiMetasploitEmerging ThreatsExploit codeFix
CVE-2026-41564CryptX versions for Perl do not reseed the Crypt::PK PRNG state after forking7.5CISA ADP v3.10.5%2026-04-23Fix
CVE-2026-41461SocialEngine blind SSRF via /core/link/preview6.3CNA v4.00.5%2026-04-23
CVE-2026-41460SocialEngine SQL injection via activity/index/get-memberall9.3CNA v4.01.0%2026-04-23
CVE-2026-41361OpenClaw SSRF Guard Bypass via IPv6 Special-Use Ranges5.1CNA v4.00.3%2026-04-23Fix
CVE-2026-41360OpenClaw Approval Integrity Bypass in pnpm dlx Local Script Binding5.4CNA v4.00.1%2026-04-23Fix
CVE-2026-41359OpenClaw privilege escalation via operator.write to Admin-Class Telegram Config and Cron Persistence8.8v3.10.4%2026-04-23Fix
CVE-2026-41358OpenClaw Sender Allowlist Bypass via Slack Thread Context2.3CNA v4.00.3%2026-04-23Fix
CVE-2026-41357OpenClaw Unsanitized Environment Variable Leakage in SSH Sandbox Backends2.0CNA v4.00.2%2026-04-23Fix
CVE-2026-41356OpenClaw Incomplete WebSocket Session Termination in device.token.rotate2.3CNA v4.00.3%2026-04-23Fix
CVE-2026-41355OpenClaw arbitrary code execution via Mirror Mode Sandbox File Conversion5.4CNA v4.00.2%2026-04-23Fix
CVE-2026-41354OpenClaw Insufficient Scope in Zalo Webhook Replay Dedupe Keys5.3v3.10.5%2026-04-23Fix
CVE-2026-41353OpenClaw allowProfiles Bypass via Profile Mutation and Runtime Selection7.6CNA v4.00.6%2026-04-23Fix
CVE-2026-41352OpenClaw remote code execution via Node Scope Gate Bypass7.7CNA v4.01.0%2026-04-23Fix
CVE-2026-41351OpenClaw Webhook Replay Detection Bypass via Base64 Signature Re-encoding6.3CNA v4.00.4%2026-04-23Fix
CVE-2026-41350OpenClaw Session Visibility Bypass via session_status in Unsandboxed Invocations5.3CNA v4.00.3%2026-04-23Fix
CVE-2026-41349OpenClaw Agentic Consent Bypass via config.patch8.7CNA v4.00.8%2026-04-23Fix
CVE-2026-41348OpenClaw Group DM Channel Allowlist Bypass via Discord Slash commands2.3CNA v4.00.3%2026-04-23Fix
CVE-2026-41347OpenClaw cross-site request forgery via Missing Browser-Origin Validation in HTTP Operator endpoints2.3CNA v4.00.2%2026-04-23Fix
CVE-2026-41346OpenClaw denial of service via Improper Pending Pairing Request Cap Enforcement7.5v3.10.8%2026-04-23Fix
CVE-2026-41345OpenClaw Authorization header leak via Cross-Origin Redirect in Media Download6.0CNA v4.00.4%2026-04-23Fix
CVE-2026-41344OpenClaw privilege escalation via chat.send /verbose parameter8.8v3.10.4%2026-04-23Fix
CVE-2026-41343OpenClaw denial of service via LINE Webhook Handler Pre-Auth Concurrency6.9CNA v4.00.8%2026-04-23Fix
CVE-2026-41342OpenClaw Unauthenticated Discovery Endpoint Credential Exfiltration via Remote Onboarding8.1v3.10.2%2026-04-23Fix
CVE-2026-41341OpenClaw Component Interaction Misclassification in Discord extension2.3CNA v4.00.2%2026-04-23Fix
CVE-2026-41340OpenClaw Authentication Boundary Bypass via Telegram Legacy allowFrom Migration6.3CNA v4.00.5%2026-04-23Fix
CVE-2026-41339OpenClaw information disclosure via Gateway Connect Snapshot5.3CNA v4.00.4%2026-04-23Fix
CVE-2026-41338OpenClaw time-of-check-time-of-use (TOCTOU) vulnerability in Sandbox File Operations4.3CNA v4.00.1%2026-04-23Fix
CVE-2026-41337OpenClaw Callback Origin Mutation in Plivo Voice-call Replay6.3CNA v4.00.3%2026-04-23Fix
CVE-2026-41336OpenClaw arbitrary Hook code execution via OPENCLAW_BUNDLED_HOOKS_DIR Environment Variable Override8.5CNA v4.00.2%2026-04-23Fix
CVE-2026-41335OpenClaw information disclosure via Control UI Bootstrap JSON6.9CNA v4.00.4%2026-04-23Fix
CVE-2026-41334OpenClaw decompression bomb denial of service via Image Pixel-Limit Guard Bypass7.1CNA v4.00.5%2026-04-23Fix
CVE-2026-41333OpenClaw Authentication Rate Limiting Bypass via Fake DeviceToken6.3CNA v4.00.4%2026-04-23Fix
CVE-2026-41332OpenClaw code execution via Missing Environment Variable Blocklist5.8CNA v4.00.1%2026-04-23Fix
CVE-2026-41279FlowiseAI Flowise text-to-speech endpoint vulnerability8.2CNA v4.00.4%2026-04-23Fix
CVE-2026-41278FlowiseAI Flowise public chatflow endpoints information disclosure8.7CNA v4.00.4%2026-04-23Fix
CVE-2026-41277Flowise: Mass assignment in DocumentStore Create endpoint leads to Cross-Workspace object takeover7.6CNA v4.00.5%2026-04-23Fix
CVE-2026-41276Flowise: AccountService resetPassword authentication bypass7.7CNA v4.00.6%2026-04-23Fix
CVE-2026-41275Flowise: Password Reset Link Sent over Unsecured HTTP7.5CNA v4.00.3%2026-04-23Fix
CVE-2026-41274Flowise: Cypher injection in GraphCypherQAChain9.3CNA v4.00.7%2026-04-23Fix
CVE-2026-41273Flowise: Unauthenticated OAuth 2.0 access token disclosure via Public Chatflow7.7CNA v4.00.4%2026-04-23Fix
CVE-2026-41272Flowise: SSRF Protection Bypass (TOCTOU and Default Insecure)7.1CNA v3.10.4%2026-04-23Fix
CVE-2026-41271Flowise: APIChain prompt injection SSRF in GET/POST API Chains7.1CNA v3.00.3%2026-04-23Fix
CVE-2026-41270Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP modules in Custom Function Sandbox7.1CNA v3.10.3%2026-04-23Fix
CVE-2026-41269Flowise: File upload Validation Bypass in createAttachment7.1CNA v3.10.7%2026-04-23Fix
CVE-2026-41268Flowise: Flowise Parameter Override Bypass remote command execution7.7CNA v3.01.2%2026-04-23Fix
CVE-2026-41267FlowiseAI Flowise account registration endpoint mass assignment8.1CNA v3.10.5%2026-04-23Fix
CVE-2026-41266Flowise: Sensitive data leak in public-chatbotConfig7.7CNA v4.00.5%2026-04-23Fix
CVE-2026-41265Flowise: Airtable_Agent code injection remote code execution9.2CNA v4.00.6%2026-04-23Fix
CVE-2026-41264Flowise: CSV agent prompt injection remote code execution9.2CNA v4.01.2%2026-04-23MetasploitExploit codeFix
CVE-2026-41259Mastodon: Insufficient verification of email addresses8.2CNA v4.00.4%2026-04-23Fix
CVE-2026-41247elFinder: Command injection in resize background color parameter when using ImageMagick CLI8.9CNA v4.02.7%2026-04-23Fix
CVE-2026-41246Contour: Lua code injection via Cookie Path Rewrite Policy8.1CNA v3.10.8%2026-04-23Fix
CVE-2026-41243siemvk OpenLearn forum post read procedure improper access control6.9CNA v4.00.3%2026-04-23
CVE-2026-41241pretalx vulnerable to stored cross-site scripting in organizer search typeahead8.7CNA v3.10.3%2026-04-23Fix
CVE-2026-41240DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate6.0CNA v4.00.4%2026-04-23Fix
CVE-2026-41239DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode6.8CNA v3.10.4%2026-04-23Fix
CVE-2026-41238DOMPurify: Prototype pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback6.9CNA v3.10.3%2026-04-23Fix
CVE-2026-41233Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid parameter in Domains.add5.4CNA v3.10.4%2026-04-23Fix
CVE-2026-41232Froxlor email sender alias validation incorrect authorization5.0CNA v3.10.3%2026-04-23Fix
CVE-2026-41231Froxlor DataDump export link following7.5CNA v3.10.5%2026-04-23Fix
CVE-2026-41230Froxlor has a BIND Zone file injection via Unsanitized DNS Record Content in DomainZones::add8.5CNA v3.10.5%2026-04-23Fix
CVE-2026-41229Froxlor has a PHP code injection9.1CNA v3.10.7%2026-04-23Fix
CVE-2026-41228Froxlor has local file inclusion10.0CNA v3.10.7%2026-04-23Fix
CVE-2026-41213node-oauth oauth2-server PKCE token exchange vulnerability5.9CNA v3.10.3%2026-04-23Fix
CVE-2026-41211Path traversal in vite-plus/binding downloadPackageManager writes outside VP_HOME8.4CNA v4.00.4%2026-04-23Fix
CVE-2026-41208Paperclip: Privilege escalation8.8CNA v3.10.8%2026-04-23Fix
CVE-2026-41206PySpector has a plugin code execution Bypass6.9CNA v4.00.2%2026-04-23Fix
CVE-2026-41205Mako: Path traversal via double-slash URI prefix in TemplateLookup7.7CNA v4.00.5%2026-04-23Fix
CVE-2026-41200NUWCDIVNPT stig-manager STIG Manager has reflected XSS vulnerability in the Web App8.5CNA v4.00.6%2026-04-23Fix
CVE-2026-41197noir-lang noir brillig: Heap corruption in foreign call results with nested tuple arrays9.3CNA v4.00.5%2026-04-23Fix
CVE-2026-41196Luanti has a mod security sandbox escape9.0CNA v4.00.7%2026-04-23Fix
CVE-2026-41182langchain-ai langsmith-sdk LangSmith SDK: Streaming token events bypass output redaction5.3CNA v3.10.4%2026-04-23Fix
CVE-2026-41180PsiTransfer upload PATCH handler path traversal7.5CNA v3.10.5%2026-04-23Fix
CVE-2026-41179Rclone operations/fsinfo RC endpoint missing authentication9.2CNA v4.05.3%2026-04-23NucleiExploit codeFix
CVE-2026-41173opentelemetry-dotnet-contrib unbounded HTTP response body read in OpenTelemetry.Sampler.AWS5.9CNA v3.10.4%2026-04-23Fix
CVE-2026-41138FlowiseAI Flowise AirtableAgent Pandas prompt code injection8.3CNA v3.00.8%2026-04-23Fix
CVE-2026-41137Flowise: Code injection in CSVAgent leads to authenticated RCE9.4CNA v4.02.1%2026-04-23Fix
CVE-2026-41078OpenTelemetry dotnet: Potential memory exhaustion5.9CNA v3.10.4%2026-04-23Fix
CVE-2026-41040GROWI regular expression denial of service8.7CNA v4.00.5%2026-04-23
CVE-2026-40894OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers5.3CNA v3.10.6%2026-04-23Fix
CVE-2026-40891OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling5.3CNA v3.10.3%2026-04-23Fix
CVE-2026-40886Argo Workflows pod garbage collection informer improper array index validation7.7CNA v3.10.6%2026-04-23Fix
CVE-2026-40529KANATA CMS ALAYA SQL injection5.1CNA v4.00.3%2026-04-23
CVE-2026-40472Hackage package metadata stored XSS9.9CNA v3.10.4%2026-04-23
CVE-2026-40471hackage-server cross-site request forgery9.6CNA v3.10.2%2026-04-23
CVE-2026-40470Hackage package and doc upload stored XSS9.9CNA v3.10.4%2026-04-23Fix
CVE-2026-40182OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies5.3CNA v3.10.6%2026-04-23Fix
CVE-2026-40062Ziosoft Ziostation2 path traversal8.7CNA v4.00.7%2026-04-23Fix
CVE-2026-39440FunnelFormsPro WordPress plugin remote code execution (RCE)9.9CNA v3.10.5%2026-04-23
CVE-2026-39087ntfy ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function9.8CISA ADP v3.10.5%2026-04-23Fix
CVE-2026-35431Microsoft Entra ID Entitlement Management spoofing10.0CNA v3.10.9%2026-04-23Fix
CVE-2026-35225Improper timeout handling in CODESYS EtherNetIP8.7CNA v4.00.6%2026-04-23Fix
CVE-2026-34488i-PRO IP Setting Software uncontrolled search path7.0CNA v4.00.2%2026-04-23
CVE-2026-34003X.Org X server XKB key types request handling out-of-bounds read7.8CNA v3.10.2%2026-04-23Fix
CVE-2026-34001X.Org X server XSync fence triggering use-after-free7.8CNA v3.10.2%2026-04-23Fix
CVE-2026-33999Red Hat Enterprise Linux 10 xorg: Xwayland: X.org x server: Denial of service7.8CNA v3.10.2%2026-04-23Fix
CVE-2026-33819Microsoft Bing remote code execution10.0CNA v3.11.5%2026-04-23Fix
CVE-2026-33694Tenable Nessus, Tenable Nessus Agent Junction File Manipulation7.4CNA v4.00.2%2026-04-23
CVE-2026-33102Microsoft 365 Copilot elevation of privilege9.3CNA v3.10.7%2026-04-23Fix
CVE-2026-32679Japan Media Systems Downloader5Installer.exe uncontrolled search path8.4CNA v4.00.2%2026-04-23Fix
CVE-2026-32210Microsoft Dynamics 365 (online) spoofing9.3CNA v3.10.7%2026-04-23Fix
CVE-2026-32172Microsoft Power Apps remote code execution8.0CNA v3.10.6%2026-04-23Fix
CVE-2026-31533Linux kernel TLS encryption offload use-after-free9.8CNA v3.10.7%2026-04-23Fix
CVE-2026-31532Linux kernel CAN raw socket use-after-free7.8CNA v3.10.2%2026-04-23Fix
CVE-2026-31531Linux kernel IPv4 nexthop netlink vulnerability5.5NVD v3.10.2%2026-04-23Fix
CVE-2026-31181TOTOLINK A3300R Firmware OS command injection9.8CISA ADP v3.11.4%2026-04-23
CVE-2026-31179TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31178TOTOLINK A3300R Firmware OS command injection9.8CISA ADP v3.11.4%2026-04-23
CVE-2026-31177TOTOLINK A3300R Firmware OS command injection9.8CISA ADP v3.11.4%2026-04-23
CVE-2026-31176TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31175TOTOLINK A3300R Firmware command injection9.8CISA ADP v3.11.4%2026-04-23
CVE-2026-31174TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31173TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31172TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31171TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31169TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31168TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31167TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31166TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31165TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31164TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31163TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31162TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31160TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-31159TOTOLINK A3300R Firmware command injection6.5CISA ADP v3.10.7%2026-04-23
CVE-2026-29198Rocket.Chat SQL injection9.8CISA ADP v3.10.6%2026-04-23Exploit code
CVE-2026-28525SWUpdate integer underflow in Multipart upload parser8.2CNA v4.00.5%2026-04-23Fix
CVE-2026-28040Taxi Booking Manager for WooCommerce WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-04-23Fix
CVE-2026-26210KTransformers unsafe deserialization RCE via balance_serve9.3CNA v4.01.0%2026-04-23
CVE-2026-26150Microsoft Purview eDiscovery elevation of privilege8.6CNA v3.11.1%2026-04-23Fix
CVE-2026-25874LeRobot unsafe deserialization remote code execution via gRPC9.8v3.11.0%2026-04-23
CVE-2026-24303Microsoft Partner Center elevation of privilege9.6CNA v3.10.4%2026-04-23Fix
CVE-2026-23751Kofax Capture Unauthenticated File Read/Write and SMB Coercion via .NET Remoting9.3CNA v4.00.9%2026-04-23Exploit code
CVE-2026-6942radare2-mcp OS command injection via Shell Metacharacter Bypass8.8NVD v3.13.0%2026-04-23Fix
CVE-2026-6941radare2 Project Notes path traversal via Symlink7.8v3.10.2%2026-04-23Fix
CVE-2026-6940radare2 Project Deletion path traversal Directory Deletion6.9CNA v4.00.2%2026-04-23Fix
CVE-2026-6921Google Chrome race condition8.3CISA ADP v3.10.2%2026-04-23Fix
CVE-2026-6920Google Chrome GPU out-of-bounds read9.6CISA ADP v3.10.3%2026-04-23Fix
CVE-2026-6919Google Chrome DevTools use-after-free9.6CISA ADP v3.10.3%2026-04-23Fix
CVE-2026-6903Path traversal vulnerability in LabOne User interface8.7CNA v4.00.3%2026-04-23Fix
CVE-2026-6887BorG Technology Corporation｜Borg SPM 2007 SQL injection9.3CNA v4.00.6%2026-04-23Fix
CVE-2026-6886BorG Technology Corporation｜Borg SPM 2007 authentication bypass9.3CNA v4.00.8%2026-04-23Fix
CVE-2026-6885BorG Technology Corporation｜Borg SPM 2007 arbitrary file upload9.3CNA v4.00.9%2026-04-23Fix
CVE-2026-6878ByteDance verl grader.py math_equal sandbox6.3CNA v4.00.4%2026-04-23
CVE-2026-6874ericc-ch copilot-api header token DNS rebinding5.3CNA v4.00.3%2026-04-23
CVE-2026-6732Libxml2: Libxml2: Denial of service via crafted xsd-validated document7.5NVD v3.10.9%2026-04-23Fix
CVE-2026-6376Missing authentication for critical function in SpiceJet Online Booking System8.7CNA v4.00.6%2026-04-23
CVE-2026-6375Authorization bypass through user-controlled key in SpiceJet Online Booking System8.7CNA v4.00.4%2026-04-23
CVE-2026-6074Path traversal: .../...// in Intrado 911 Emergency Gateway (EGW)9.3CNA v4.00.7%2026-04-23Fix
CVE-2026-5935IBM TSSC/IMC is vulnerable to OS command injection7.3CNA v3.10.5%2026-04-23Fix
CVE-2026-5926IBM Verify Identity Access weak cryptographic algorithm6.5CNA v3.10.2%2026-04-23Fix
CVE-2026-5464ExactMetrics connect_process AJAX endpoint missing authorization7.2CNA v3.11.0%2026-04-23Fix
CVE-2026-5039Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N6.1CNA v4.00.2%2026-04-23Fix
CVE-2026-4919IBM Guardium Data Protection Web UI cross-site scripting4.8CNA v3.10.2%2026-04-23Fix
CVE-2026-4918IBM Guardium Data Protection Web UI stored cross-site scripting5.5CNA v3.10.2%2026-04-23Fix
CVE-2026-4917IBM Guardium Data Protection path traversal4.9CNA v3.10.4%2026-04-23Fix
CVE-2026-4512WP reCaptcha by WebDesignBy Admin+ stored XSS3.5CISA ADP v3.10.2%2026-04-23Fix
CVE-2026-4106HT Mega Unauthenticated PII Disclosure5.3CISA ADP v3.10.7%2026-04-23NucleiExploit codeFix
CVE-2026-3960Remote code execution in h2oai/h2o-39.8v3.10.9%2026-04-23Fix
CVE-2026-3844Breeze Cache WordPress plugin unauthenticated arbitrary file upload via fetch_gravatar_from_remote9.8CNA v3.13.8%2026-04-23Reported exploitedNucleiExploit codeFix
CVE-2026-3621IBM WebSphere Application Server Liberty is affected by identity spoofing7.5CNA v3.10.4%2026-04-23Fix
CVE-2026-3361WP Store Locator WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-23Fix
CVE-2026-3259Sensitive data disclosure in BigQuery via Materialized View Error messages7.1CNA v4.00.4%2026-04-23Fix
CVE-2026-3007Three Learning Koollab Learning Management System stored cross-site scripting (XSS)5.4CNA v3.10.2%2026-04-23
CVE-2026-2951Gutentor WordPress plugin stored cross-site scripting5.4CNA v3.10.2%2026-04-23Fix
CVE-2026-2708Libsoup: Libsoup: Http request smuggling via duplicate content-length headers5.3NVD v3.10.4%2026-04-23Fix
CVE-2026-1923Social Rocket Social Sharing WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-23Fix
CVE-2026-1726IBM Guardium Key Lifecycle Manager privilege escalation4.8CISA ADP v3.10.2%2026-04-23Fix
CVE-2026-1352IBM Db2 query compiler denial of service6.5CNA v3.10.3%2026-04-23Fix
CVE-2026-1274IBM Guardium Data Protection access management control panel business logic error4.9CNA v3.10.3%2026-04-23Fix
CVE-2026-1272IBM Guardium Data Protection user access control panel insufficient session expiration2.7CNA v3.10.2%2026-04-23Fix
CVE-2026-41667Samsung Open Source ONE constant tensor data size calculation integer overflow6.6CNA v3.10.1%2026-04-22
CVE-2026-41666Samsung Open Source ONE tensor copy size calculation integer overflow6.6CNA v3.10.1%2026-04-22
CVE-2026-41665Samsung Open Source ONE integer overflow6.1CNA v3.10.1%2026-04-22
CVE-2026-41664Samsung Open Source ONE memory copy size calculation integer overflow6.6CNA v3.10.1%2026-04-22
CVE-2026-41651PackageKit transaction flag handling race condition8.8CNA v3.10.5%2026-04-22Exploit codeFix
CVE-2026-41469Beghelli Sicuro24 SicuroWeb Missing Content Security Policy5.1CNA v4.00.3%2026-04-22
CVE-2026-41468Beghelli Sicuro24 SicuroWeb AngularJS sandbox escape via template injection9.3CNA v4.00.7%2026-04-22
CVE-2026-41459thexerteproject xerteonlinetoolkits Xerte Online Toolkits path disclosure via /setup6.9CNA v4.01.1%2026-04-22MetasploitExploit codeKCVFix
CVE-2026-41458OwnTone server race condition DoS via DAAP Login8.2CNA v4.00.5%2026-04-22Fix
CVE-2026-41457OwnTone server SQL injection via query and filter parameters6.9CNA v4.00.4%2026-04-22Fix
CVE-2026-41455WeKan SSRF via Webhook URL6.3CNA v4.00.4%2026-04-22Fix
CVE-2026-41454WeKan missing authorization via Integration REST API8.7CNA v4.00.5%2026-04-22Fix
CVE-2026-41314pypdf FlateDecode image decoder excessive memory allocation4.8CNA v4.00.4%2026-04-22Fix
CVE-2026-41313pypdf incremental mode parser excessive iteration4.8CNA v4.00.4%2026-04-22Fix
CVE-2026-41312pypdf FlateDecode decoder excessive memory allocation4.8CNA v4.00.4%2026-04-22Fix
CVE-2026-41304WWBN AVideo vulnerable to RCE caused by clonesite plugin8.9CNA v4.02.7%2026-04-22
CVE-2026-41177Squidex has blind SSRF via file:// protocol in Restore API leading to Local File Interaction5.5CNA v3.10.4%2026-04-22Fix
CVE-2026-41176Rclone options/set RC endpoint missing authentication9.2CNA v4.03.2%2026-04-22Reported exploitedNucleiEmerging ThreatsFix
CVE-2026-41175Statamic: Unsafe method invocation via query value resolution allows data destruction8.1CNA v3.10.6%2026-04-22Fix
CVE-2026-41172Squidex vulnerable to server-side request forgery7.3CNA v4.00.4%2026-04-22Fix
CVE-2026-41171Squidex Jint scripting engine HTTP client server-side request forgery7.3CNA v4.00.4%2026-04-22Fix
CVE-2026-41170Squidex backup restore endpoint server-side request forgery7.2CNA v4.00.4%2026-04-22Fix
CVE-2026-41168pypdf has possible long runtimes for wrong size values in cross-reference and object streams6.9CNA v4.00.5%2026-04-22Fix
CVE-2026-41167Jellystat has SQL injection that leads to to remote code execution9.1CNA v3.10.9%2026-04-22Fix
CVE-2026-41166OpenRemote has improper access control via updateUserRealmRoles function7.0CNA v3.10.3%2026-04-22Fix
CVE-2026-41146facil.io JSON parser infinite loop8.7CNA v4.00.4%2026-04-22Fix
CVE-2026-41145MinIO unsigned trailer upload handler authentication bypass8.8CNA v4.00.6%2026-04-22Fix
CVE-2026-41144nasa fprime F´ (F Prime) has integer overflow in FileUplink0.0CNA v3.10.8%2026-04-22Fix
CVE-2026-41136free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer5.5CNA v4.00.3%2026-04-22Fix
CVE-2026-41135free5GC PCF: Memory leak via CORS Middleware Registration in HTTP handler leads to denial of service7.5CNA v3.10.5%2026-04-22Fix
CVE-2026-41134Microsoft Kiota: Code Generation Literal injection7.3CNA v4.00.4%2026-04-22Fix
CVE-2026-41133pyLoad has Stale Session Privilege after Role/Permission Change (Privilege Revocation Bypass)8.8CNA v3.10.5%2026-04-22
CVE-2026-41131OpenFGA has Improper Policy Enforcement5.0CNA v3.10.2%2026-04-22Fix
CVE-2026-41130Craft CMS has a host header injection leading to SSRF via resource-js endpoint5.5CNA v4.00.4%2026-04-22Fix
CVE-2026-41129Craft CMS has server-side request forgery (SSRF) with Asset Uploads Mutations5.5CNA v4.00.4%2026-04-22Fix
CVE-2026-41128Craft CMS has a missing authorization Check on User Group Removal via save-permissions action5.3CNA v4.00.4%2026-04-22Fix
CVE-2026-41127BigBlueButton's missing authorization allows viewer to inject/overwrite captions6.5CNA v3.10.3%2026-04-22Fix
CVE-2026-41126BigBlueButton has open redirect through bigbluebutton/API/join via get-parameter logoutURL4.3CNA v3.10.3%2026-04-22Fix
CVE-2026-41064AVideo has an incomplete fix for (command injection)9.3CNA v3.10.5%2026-04-22
CVE-2026-41059OAuth2 Proxy has an authentication bypass8.2CNA v3.10.4%2026-04-22Fix
CVE-2026-40937RustFS notification target admin API missing authorization8.3CNA v3.10.5%2026-04-22Fix
CVE-2026-40882OpenRemote has XXE in Velbus Asset Import7.6CNA v3.10.4%2026-04-22Fix
CVE-2026-40542Apache HttpClient SCRAM-SHA-256 authentication missing authentication step7.3CISA ADP v3.10.7%2026-04-22Fix
CVE-2026-40517radare2 command injection via PDB Parser Symbol Names8.4CNA v4.01.7%2026-04-22Fix
CVE-2026-40451DeepL Chrome browser extension cross-site scripting5.1CNA v4.00.3%2026-04-22
CVE-2026-40450Samsung Open Source ONE output tensor copy size calculation integer overflow6.6CNA v3.10.1%2026-04-22
CVE-2026-40449Samsung Open Source ONE buffer size calculation integer overflow6.6CNA v3.10.1%2026-04-22
CVE-2026-40448Samsung Open Source ONE tensor allocation size calculation integer overflow5.3CNA v3.10.1%2026-04-22
CVE-2026-40344MinIO Snowball auto-extract handler missing authentication8.8CNA v4.00.7%2026-04-22Fix
CVE-2026-40343free5GC UDR policy data subscription notification endpoint vulnerability6.9CNA v4.00.3%2026-04-22Emerging ThreatsFix
CVE-2026-35548Guardsix Logpoint server-side request forgery8.5CISA ADP v3.10.3%2026-04-22Fix
CVE-2026-35381Uutils coreutils cut local logic error and Data Integrity issue in Output Filtering3.3CNA v3.10.2%2026-04-22Fix
CVE-2026-35380Uutils coreutils cut local logic error and Data Integrity issue in Delimiter Parsing5.5CNA v3.10.2%2026-04-22Fix
CVE-2026-35379Uutils coreutils tr local logic error and Data Integrity issue in Character Class Handling3.3CNA v3.10.2%2026-04-22Fix
CVE-2026-35378Uutils coreutils expr local denial of service via Eager Evaluation of Parenthesized Subexpressions3.3CNA v3.10.2%2026-04-22Fix
CVE-2026-35377Uutils coreutils env local denial of service3.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35376Uutils coreutils has a time-of-check time-of-use (TOCTOU) race condition5.8NVD v3.10.1%2026-04-22Fix
CVE-2026-35375Uutils coreutils split Local Data Integrity issue via Lossy Filename Encoding3.3CNA v3.10.2%2026-04-22Fix
CVE-2026-35374Uutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use race condition6.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35373Uutils coreutils ln local denial of service via Improper Handling of Non-UTF-8 Filenames5.5NVD v3.10.1%2026-04-22Fix
CVE-2026-35372Uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag5.0CNA v3.10.2%2026-04-22Fix
CVE-2026-35371Uutils coreutils id Misleading Identity Reporting in Pretty Print Mode3.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35370Uutils coreutils id Incorrect Access-Control Decisions via Misrepresented Group Membership4.4CNA v3.10.1%2026-04-22Fix
CVE-2026-35369Uutils coreutils kill System-wide Process Termination and denial of service5.5CNA v3.10.2%2026-04-22Fix
CVE-2026-35368Uutils coreutils chroot local privilege escalation and chroot Escape in7.2CNA v3.10.1%2026-04-22Fix
CVE-2026-35367Uutils coreutils nohup information disclosure via insecure default Output Permissions3.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35366Uutils coreutils printenv Security Inspection Bypass via UTF-8 Enforcement4.4CNA v3.10.2%2026-04-22Fix
CVE-2026-35365Uutils coreutils mv denial of service and Data Duplication via Improper Symlink Expansion6.6CNA v3.10.2%2026-04-22Fix
CVE-2026-35364Uutils coreutils mv arbitrary file overwrite via Cross-device TOCTOU race condition6.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35363Uutils coreutils rm Safeguard Bypass via Improper Path Normalization5.6CNA v3.10.2%2026-04-22Fix
CVE-2026-35362Uutils coreutils missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal module3.6CNA v3.10.2%2026-04-22Fix
CVE-2026-35361Uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems4.4NVD v3.10.1%2026-04-22Fix
CVE-2026-35360Uutils coreutils touch Arbitrary File Truncation via TOCTOU race condition6.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35359Uutils coreutils cp information disclosure via Time-of-Check to Time-of-Use Symlink Swap4.7CNA v3.10.1%2026-04-22Fix
CVE-2026-35358Uutils coreutils cp Semantic Loss and potential denial of service with -R5.5NVD v3.10.2%2026-04-22Fix
CVE-2026-35357Uutils coreutils cp information disclosure via Permission Handling Race4.7CNA v3.10.1%2026-04-22Fix
CVE-2026-35356Uutils coreutils install arbitrary file overwrite with -D via Path Component Symlink Race6.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35355Uutils coreutils install arbitrary file overwrite via Symlink TOCTOU Race6.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35354Uutils coreutils mv Security Xattr TOCTOU Race in Cross-Device4.7CNA v3.10.1%2026-04-22Fix
CVE-2026-35353Uutils coreutils mkdir Permission Exposure race condition with -m3.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35352Uutils coreutils mkfifo privilege escalation via TOCTOU race condition7.0CNA v3.10.1%2026-04-22Fix
CVE-2026-35351Uutils coreutils mv Silent Ownership Loss in Cross-Device Operations4.2CNA v3.10.1%2026-04-22Fix
CVE-2026-35350Uutils coreutils cp Unexpected Privileged Executable Creation with -p6.6CNA v3.10.1%2026-04-22Fix
CVE-2026-35349Uutils coreutils Path-Based Safety Bypass with --preserve-root7.7NVD v3.10.2%2026-04-22Fix
CVE-2026-35348Uutils coreutils sort local denial of service via Forced UTF-8 Parsing5.5CNA v3.10.1%2026-04-22Fix
CVE-2026-35347Uutils coreutils comm Silent Data Loss or denial of service via improper input validation4.4CNA v3.10.1%2026-04-22Fix
CVE-2026-35346Uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization3.3CNA v3.10.2%2026-04-22Fix
CVE-2026-35345Uutils coreutils tail Privileged information disclosure via Symlink Replacement Race5.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35344Uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression3.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35343Uutils coreutils cut Inconsistent Output Suppression with Newline Delimiters3.3CNA v3.10.1%2026-04-22Fix
CVE-2026-35342Uutils coreutils mktemp insecure temporary file Placement via Empty TMPDIR3.3CNA v3.10.2%2026-04-22Fix
CVE-2026-35341Uutils coreutils mkfifo Unauthorized Permission Change on Existing files7.1CNA v3.10.1%2026-04-22Fix
CVE-2026-35340Uutils coreutils chown and chgrp False Success Exit Code in Recursive Mode5.5CNA v3.10.2%2026-04-22Fix
CVE-2026-35339Uutils coreutils chmod False Success Exit Code in Recursive Mode5.5CNA v3.10.2%2026-04-22Fix
CVE-2026-35338Uutils coreutils chmod path traversal Bypass of --preserve-root7.3CNA v3.10.2%2026-04-22Fix
CVE-2026-34415thexerteproject xerteonlinetoolkits xerte Online Toolkits file upload RCE via elfinder Connector9.3CNA v4.04.4%2026-04-22MetasploitExploit codeKCVFix
CVE-2026-34414thexerteproject xerteonlinetoolkits Xerte Online Toolkits path traversal via connector.php7.1CNA v4.03.6%2026-04-22MetasploitExploit codeKCVFix
CVE-2026-34413thexerteproject xerteonlinetoolkits Xerte Online Toolkits missing authentication via connector.php8.8CNA v4.03.1%2026-04-22NucleiMetasploitExploit codeKCVFix
CVE-2026-34068nimiq-transaction UpdateValidator transaction voting key improper signature verification6.8CNA v3.10.3%2026-04-22Fix
CVE-2026-34067nimiq-transaction vulnerable to panic via `HistoryTreeProof` length mismatch3.1CNA v3.10.4%2026-04-22Fix
CVE-2026-34066nimiq-blockchain history sync store reachable assertion5.3CNA v3.10.4%2026-04-22Fix
CVE-2026-34065nimiq-primitives election macro block validator keys unchecked return value7.5CNA v3.10.6%2026-04-22Fix
CVE-2026-34064nimiq-account vesting contract balance check integer underflow5.3CNA v3.10.5%2026-04-22Fix
CVE-2026-34063Nimiq network-libp2p discovery protocol connection handler reachable assertion7.5CNA v3.10.6%2026-04-22Fix
CVE-2026-34062Nimiq has allocation of resources without limits or throttling in its libp2p request/response5.3CNA v3.10.5%2026-04-22Fix
CVE-2026-33733EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete7.2CNA v3.10.6%2026-04-22Fix
CVE-2026-33656EspoCRM vulnerable to authenticated RCE9.1CNA v3.10.6%2026-04-22Exploit codeFix
CVE-2026-33611PowerDNS Authoritative insufficient validation of HTTPS and SVCB records6.5CNA v3.10.8%2026-04-22Fix
CVE-2026-33610PowerDNS Authoritative possible file descriptor exhaustion in forward-dnsupdate5.9CNA v3.10.7%2026-04-22Fix
CVE-2026-33609PowerDNS Authoritative LDAP DN injection5.3CNA v3.10.5%2026-04-22Fix
CVE-2026-33608PowerDNS Authoritative incomplete domain name sanitization during7.4CNA v3.10.6%2026-04-22Fix
CVE-2026-33602PowerDNS DNSdist off-by-one access when processing crafted UDP responses6.5CNA v3.11.2%2026-04-22Fix
CVE-2026-33601PowerDNS Recursor insufficient validation of zonemd record4.4CNA v3.10.7%2026-04-22Fix
CVE-2026-33600PowerDNS Recursor null pointer dereference in RPZ transfer4.4CNA v3.10.7%2026-04-22Fix
CVE-2026-33599PowerDNS DNSdist out-of-bounds read in service discovery3.1CNA v3.10.8%2026-04-22Fix
CVE-2026-33598PowerDNS DNSdist out-of-bounds read in cache inspection via Lua4.8CNA v3.12.8%2026-04-22Fix
CVE-2026-33597PowerDNS DNSdist PRSD detection denial of service3.7CNA v3.10.8%2026-04-22Fix
CVE-2026-33596PowerDNS DNSdist TCP backend stream ID overflow3.1CNA v3.10.4%2026-04-22Fix
CVE-2026-33595PowerDNS DNSdist DoQ/DoH3 excessive memory allocation5.3CNA v3.10.8%2026-04-22Fix
CVE-2026-33594PowerDNS DNSdist outgoing DoH excessive memory allocation5.3CNA v3.10.8%2026-04-22Fix
CVE-2026-33593PowerDNS DNSdist denial of service via crafted DNSCrypt query7.5CNA v3.10.8%2026-04-22Fix
CVE-2026-33471nimiq-block has skip block quorum bypass via out-of-range BitSet indices and u16 truncation9.6CNA v3.10.3%2026-04-22Fix
CVE-2026-33262PowerDNS Recursor insufficient validation of cookie reply5.9CNA v3.10.5%2026-04-22Fix
CVE-2026-33261PowerDNS Recursor null pointer accces in aggressive NSEC(3) cache5.9CNA v3.10.2%2026-04-22Fix
CVE-2026-33260PowerDNS Authoritative insufficient input validation of internal webserver5.3CNA v3.11.1%2026-04-22Fix
CVE-2026-33259PowerDNS Recursor concurrent modification of RPZ data can lead to denial of servce5.0CNA v3.10.3%2026-04-22Fix
CVE-2026-33258PowerDNS Recursor crafted zones can cause increased resource usage5.3CNA v3.10.8%2026-04-22Fix
CVE-2026-33257PowerDNS Authoritative insufficient input validation of internal webserver5.3CNA v3.11.1%2026-04-22Fix
CVE-2026-33256PowerDNS Recursor unbounded memory allocation by internal web server5.3CNA v3.10.8%2026-04-22Fix
CVE-2026-33254PowerDNS DNSdist resource exhaustion via DoQ/DoH3 connections5.3CNA v3.10.8%2026-04-22Fix
CVE-2026-32885DDEV has ZipSlip path traversal in tar and zip archive extraction6.5CNA v3.10.5%2026-04-22Fix
CVE-2026-31530Linux kernel CXL port driver use-after-free7.8NVD v3.10.1%2026-04-22Fix
CVE-2026-31529Linux kernel CXL region driver memory leak5.5v3.10.1%2026-04-22Fix
CVE-2026-31528Linux kernel perf events subsystem out-of-bounds read7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31527Linux kernel driver core platform bus use-after-free7.8v3.10.1%2026-04-22Fix
CVE-2026-31526Linux kernel BPF exception handling improper locking5.5NVD v3.10.1%2026-04-22Fix
CVE-2026-31525Linux kernel BPF interpreter out-of-bounds write7.8CNA v3.10.2%2026-04-22Exploit codeFix
CVE-2026-31524Linux kernel Asus HID driver memory leak5.5v3.10.1%2026-04-22Fix
CVE-2026-31523Linux kernel NVMe PCI polled queue race condition4.7v3.10.1%2026-04-22Fix
CVE-2026-31522Linux kernel magicmouse memory leak5.5v3.10.1%2026-04-22Fix
CVE-2026-31521Linux kernel module loader symbol resolution out-of-bounds write5.5NVD v3.10.2%2026-04-22Fix
CVE-2026-31520Linux kernel Apple HID driver memory leak5.5v3.10.1%2026-04-22Fix
CVE-2026-31519Linux kernel Btrfs subvolume creation null pointer dereference5.5v3.10.1%2026-04-22Fix
CVE-2026-31518Linux kernel ESP over TCP (espintcp) memory leak5.5NVD v3.10.2%2026-04-22Fix
CVE-2026-31517Linux kernel iptfs kernel panic5.5v3.10.1%2026-04-22Fix
CVE-2026-31516Linux kernel XFRM policy hash rebuild race condition7.8CNA v3.10.1%2026-04-22Fix
CVE-2026-31515Linux kernel af_key crash5.5NVD v3.10.2%2026-04-22Fix
CVE-2026-31514Linux kernel erofs file-backed I/O vulnerability5.5NVD v3.10.2%2026-04-22Fix
CVE-2026-31513Linux kernel L2CAP Enhanced Credit Based connection request out-of-bounds read8.1CNA v3.10.4%2026-04-22Fix
CVE-2026-31512Linux kernel L2CAP Enhanced Credit Based Flow Control vulnerability5.5v3.10.1%2026-04-22Fix
CVE-2026-31511Linux kernel Bluetooth MGMT advertising pattern monitor use-after-free7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31510Linux kernel L2CAP socket ready callback null pointer dereference5.5v3.10.1%2026-04-22Fix
CVE-2026-31509Linux kernel NFC NCI device close vulnerability5.5v3.10.1%2026-04-22Fix
CVE-2026-31508In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, the netdev_destroy()7.8CNA v3.10.1%2026-04-22Fix
CVE-2026-31507Linux kernel SMC splice pipe buffer handling double free7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31506Linux kernel bcmasp Ethernet driver double free7.8NVD v3.10.2%2026-04-22Fix
CVE-2026-31505Linux kernel iavf Ethernet driver out-of-bounds write7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31504Linux kernel net use-after-free7.8CNA v3.10.1%2026-04-22Fix
CVE-2026-31503Linux kernel UDP bind conflict detection vulnerability5.5NVD v3.10.1%2026-04-22Fix
CVE-2026-31502Linux kernel team type confusion7.8CNA v3.10.1%2026-04-22Fix
CVE-2026-31501Linux kernel ICSSG Ethernet driver receive path use-after-free9.8CNA v3.10.4%2026-04-22Fix
CVE-2026-31500Linux kernel btintel hardware error recovery use-after-free7.8NVD v3.10.2%2026-04-22Fix
CVE-2026-31499Linux kernel L2CAP connection teardown deadlock5.5v3.10.1%2026-04-22Fix
CVE-2026-31498Linux kernel L2CAP ERTM reconfiguration infinite loop5.5v3.10.1%2026-04-22Fix
CVE-2026-31497Linux kernel Bluetooth USB SCO altsetting lookup vulnerability5.5v3.10.1%2026-04-22Fix
CVE-2026-31496Linux kernel conntrack expectation proc interface vulnerability5.5NVD v3.10.2%2026-04-22Fix
CVE-2026-31495Linux kernel netfilter ctnetlink vulnerability5.5NVD v3.10.2%2026-04-22Fix
CVE-2026-31494Linux kernel macb Ethernet driver out-of-bounds write7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31493Linux kernel EFA RDMA driver use-after-free7.8NVD v3.10.2%2026-04-22Fix
CVE-2026-31492Linux kernel irdma QP creation vulnerability5.5v3.10.1%2026-04-22Fix
CVE-2026-31491Linux kernel irdma queue depth calculation integer overflow5.5v3.10.1%2026-04-22Fix
CVE-2026-31490Linux kernel Xe SR-IOV PF migration restore use-after-free7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31489Linux kernel meson-spicc SPI controller driver double free7.8v3.10.1%2026-04-22Fix
CVE-2026-31488Linux kernel AMD display DSC validation use-after-free7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31487Linux kernel SPI driver_override handling use-after-free5.5NVD v3.10.1%2026-04-22Fix
CVE-2026-31486Linux kernel PMBus regulator operations race condition7.1CNA v3.10.1%2026-04-22Fix
CVE-2026-31485Linux kernel fsl-lpspi SPI driver use-after-free7.8NVD v3.10.2%2026-04-22Fix
CVE-2026-31484Linux kernel io_uring fdinfo SQE_MIXED handling out-of-bounds read7.1CNA v3.10.2%2026-04-22Fix
CVE-2026-31483Linux kernel s390 syscall dispatch table vulnerability5.5v3.10.1%2026-04-22Fix
CVE-2026-31482Linux kernel s390 kernel entry register handling vulnerability5.5v3.10.1%2026-04-22Fix
CVE-2026-31481Linux kernel ftrace trigger data cleanup null pointer dereference5.5v3.10.1%2026-04-22Fix
CVE-2026-31480Linux kernel osnoise tracer CPU hotplug handling deadlock5.5v3.10.1%2026-04-22Fix
CVE-2026-31479Linux kernel Xe GPU VM bind and unbind vulnerability7.8CNA v3.10.1%2026-04-22Fix
CVE-2026-31478Linux kernel SMB2 response buffer length calculation vulnerability9.8CNA v3.10.7%2026-04-22Fix
CVE-2026-31477Linux kernel SMB2 lock handling null pointer dereference7.5CNA v3.10.7%2026-04-22Fix
CVE-2026-31476Linux kernel ksmbd session binding denial of service8.2CNA v3.10.7%2026-04-22Fix
CVE-2026-31475Linux kernel sma1307 double free7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31474Linux kernel ISOTP CAN protocol use-after-free7.8CNA v3.10.1%2026-04-22Fix
CVE-2026-31473Linux kernel media request API use-after-free7.8CNA v3.10.1%2026-04-22Fix
CVE-2026-31472Linux kernel iptfs infinite loop5.5v3.10.1%2026-04-22Fix
CVE-2026-31471Linux kernel iptfs double free7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31470Linux kernel TDX guest attestation quote buffer out-of-bounds write7.1CNA v3.10.2%2026-04-22Fix
CVE-2026-31469Linux kernel virtio_net driver use-after-free7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31468Linux kernel VFIO PCI dma-buf export double free7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31467Linux kernel EROFS bio completion deadlock7.5CNA v3.10.5%2026-04-22Fix
CVE-2026-31466Linux kernel huge memory folio splitting race condition4.7NVD v3.10.1%2026-04-22Fix
CVE-2026-31465Linux kernel writeback sync handling vulnerability5.5v3.10.1%2026-04-22Fix
CVE-2026-31464Linux kernel ibmvfc SCSI driver out-of-bounds read8.1CNA v3.10.4%2026-04-22Fix
CVE-2026-31463Linux kernel iomap folio read handling vulnerability9.8CNA v3.10.6%2026-04-22Fix
CVE-2026-31462In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent immediate PASID reuse case PASID resue could cause interrupt issue when process immediately runs into hw state left by previous process exited with the same PASID, it's possible that page faults are still pendi5.5NVD v3.10.1%2026-04-22Fix
CVE-2026-31461Linux kernel AMD display driver memory leak5.5v3.10.1%2026-04-22Fix
CVE-2026-31460Linux kernel AMD display backlight driver vulnerability5.5v3.10.1%2026-04-22Fix
CVE-2026-31459Linux kernel DAMON sysfs interface memory leak5.5v3.10.1%2026-04-22Fix
CVE-2026-31458Linux kernel DAMON sysfs interface null pointer dereference5.5v3.10.1%2026-04-22Fix
CVE-2026-31457Linux kernel DAMON sysfs interface null pointer dereference5.5v3.10.1%2026-04-22Fix
CVE-2026-31456Linux kernel page table walker race condition4.7v3.10.1%2026-04-22Fix
CVE-2026-31455Linux kernel XFS unmount inode reclaim use-after-free7.8v3.10.1%2026-04-22Fix
CVE-2026-31454Linux kernel XFS AIL log item push use-after-free7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31453Linux kernel XFS AIL log item push vulnerability7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31452Linux kernel ext4 inline data truncation reachable assertion7.8NVD v3.10.2%2026-04-22Fix
CVE-2026-31451Linux kernel ext4 inline data reading reachable assertion5.5NVD v3.10.1%2026-04-22Fix
CVE-2026-31450Linux kernel ext4 journal inode initialization null pointer dereference8.8CNA v3.10.6%2026-04-22Fix
CVE-2026-31449Linux kernel ext4 extent tree index correction out-of-bounds read7.8CNA v3.10.1%2026-04-22Fix
CVE-2026-31448Linux kernel ext4 extent mapping infinite loop9.4CNA v3.10.5%2026-04-22Fix
CVE-2026-31447Linux kernel ext4 bigalloc mount handling vulnerability7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31446Linux kernel ext4 sysfs error reporting use-after-free7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31445Linux kernel DAMON core vulnerability5.5v3.10.1%2026-04-22Fix
CVE-2026-31444Linux kernel ksmbd oplock handling use-after-free9.8CNA v3.10.7%2026-04-22Fix
CVE-2026-31443Linux kernel idxd driver vulnerability5.5v3.10.1%2026-04-22Fix
CVE-2026-31442Linux kernel idxd function level reset recovery out-of-bounds read7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-31441Linux kernel idxd workqueue reset memory leak5.5NVD v3.10.2%2026-04-22Fix
CVE-2026-31440Linux kernel idxd event log memory leak5.5v3.10.1%2026-04-22Fix
CVE-2026-31439Linux kernel Xilinx XDMA regmap initialization improper error handling5.5v3.10.1%2026-04-22Fix
CVE-2026-31438Linux kernel netfs iterator type handling null pointer dereference5.5v3.10.1%2026-04-22Fix
CVE-2026-31437Linux kernel netfs unbuffered write retry null pointer dereference5.5v3.10.1%2026-04-22Fix
CVE-2026-31436Linux kernel idxd null pointer dereference9.8CNA v3.10.7%2026-04-22Fix
CVE-2026-31435Linux kernel netfs read retry handling out-of-bounds read8.8CNA v3.10.5%2026-04-22Fix
CVE-2026-31434Linux kernel btrfs space_info sysfs entries memory leak5.5v3.10.1%2026-04-22Fix
CVE-2026-31433Linux kernel ksmbd file information query handler out-of-bounds read8.8CNA v3.10.7%2026-04-22Fix
CVE-2026-31432Linux kernel ksmbd QUERY_INFO handler out-of-bounds write8.8CNA v3.10.6%2026-04-22Fix
CVE-2026-31431Linux Kernel incorrect resource transfer between spheres7.8CNA v3.13.4%2026-04-22KEVExploit codeKCVFix
CVE-2026-31192Raindrop improper input validation6.5CISA ADP v3.10.4%2026-04-22
CVE-2026-30139Silverpeas Core has a reflected cross-site scripting6.1CISA ADP v3.10.3%2026-04-22
CVE-2026-28950Apple iPadOS personal information exposure6.2CISA ADP v3.10.2%2026-04-22Fix
CVE-2026-26354Dell PowerProtect Data Domain stack-based buffer overflow8.1CNA v3.10.7%2026-04-22Fix
CVE-2026-22754Spring Security ervlet Path not Correctly Included in Path Matching of XML Authorization Rules7.5CNA v3.10.3%2026-04-22Fix
CVE-2026-22753VMware Spring Security securityMatchers path matching vulnerability7.5CNA v3.10.2%2026-04-22Fix
CVE-2026-22748VMware Spring Security JWT decoding improper input validation5.3CNA v3.10.2%2026-04-22Fix
CVE-2026-22747Spring Security Unauthorized User Impersonation when using X.509 Client Certificates6.8CNA v3.10.3%2026-04-22Fix
CVE-2026-22746Spring Security User Attribute Enumeration when using DaoAuthenticationProvider3.7CNA v3.10.2%2026-04-22Fix
CVE-2026-6862efivar libefiboot device path node parser uncontrolled recursion5.5CNA v3.10.2%2026-04-22Fix
CVE-2026-6861Emacs: Emacs: Memory corruption vulnerability when processing svg css7.1NVD v3.10.2%2026-04-22Fix
CVE-2026-6859Instructlab: Instructlab: Arbitrary code execution due to hard-coded `trust_remote_code=true`8.8CNA v3.10.8%2026-04-22
CVE-2026-6857Red Hat build of Apache Camel camel-infinispan: Camel-infinispan: Remote code execution7.5CNA v3.11.2%2026-04-22Exploit codeFix
CVE-2026-6855Instructlab: Instructlab: Path traversal allows arbitrary directory creation and file write7.1CNA v3.10.2%2026-04-22
CVE-2026-6848Quay: Red Hat quay: Authentication bypass allows privileged actions without valid credentials5.4CNA v3.10.4%2026-04-22
CVE-2026-6846Binutils: Binutils: Arbitrary code execution via malformed xcoff object file processing7.8CNA v3.10.2%2026-04-22Fix
CVE-2026-6845Binutils: Binutils: Denial of service via crafted elf file5.0CNA v3.10.1%2026-04-22Fix
CVE-2026-6844Binutils: Binutils: Denial of service vulnerabilities in readelf via crafted elf files5.5CNA v3.10.1%2026-04-22
CVE-2026-6843Nano: Nano: Format string vulnerability leads to denial of service5.5CNA v3.10.1%2026-04-22Fix
CVE-2026-6842nano incorrect permission assignment2.5CNA v3.10.1%2026-04-22Fix
CVE-2026-6840Samsung Open Source ONE improper array index validation5.5CNA v3.10.1%2026-04-22
CVE-2026-6839Samsung Open Source ONE improper quantity validation6.6CNA v3.10.1%2026-04-22
CVE-2026-6835AEnrich｜a+HCM arbitrary file upload5.1CNA v4.00.3%2026-04-22Fix
CVE-2026-6834AEnrich｜a+HRD missing authorization7.1CNA v4.00.4%2026-04-22Fix
CVE-2026-6833AEnrich｜a+HRD SQL injection7.1CNA v4.00.5%2026-04-22Fix
CVE-2026-6515Insufficient session expiration in GitLab5.4CNA v3.10.2%2026-04-22Fix
CVE-2026-6416Tanium addressed an uncontrolled resource consumption vulnerability in Interact2.7CNA v3.10.4%2026-04-22Fix
CVE-2026-6408Tanium addressed an information disclosure vulnerability in Tanium Server2.7CNA v3.10.3%2026-04-22Fix
CVE-2026-6396Fast and Fancy Filter 3F WordPress plugin cross-site request forgery to settings modification4.3CNA v3.10.2%2026-04-22
CVE-2026-6392Tanium addressed an information disclosure vulnerability in Threat Response2.7CNA v3.10.3%2026-04-22Fix
CVE-2026-6386FreeBSD missing large page handling in pmap_pkru_update_range6.2CISA ADP v3.10.2%2026-04-22Fix
CVE-2026-6356Augmentt privilege escalation9.6CISA ADP v3.10.4%2026-04-22Exploit code
CVE-2026-6355Augmentt insecure direct object reference6.5CISA ADP v3.10.3%2026-04-22Exploit code
CVE-2026-6294Google PageRank Display WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-04-22
CVE-2026-6246Simple Random Posts Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22
CVE-2026-6236Posts map WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22
CVE-2026-6235Sendmachine for WordPress plugin unauthenticated SMTP Hijack to privilege escalation9.8CNA v3.10.7%2026-04-22Fix
CVE-2026-6041Buzz Comments WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-04-22
CVE-2026-6023Deserialization of untrusted data vulnerability in Telerik UI for ASP.NET AJAX8.1CNA v3.10.7%2026-04-22Fix
CVE-2026-6022Uncontrolled resource consumption vulnerability in Telerik UI for ASP.NET AJAX7.5CNA v3.10.5%2026-04-22Fix
CVE-2026-6019Python CPython BaseCookie.js_output does not neutralize embedded characters2.1CNA v4.00.6%2026-04-22Fix
CVE-2026-5820Zypento Blocks WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22
CVE-2026-5816Improper Resolution of Path Equivalence in GitLab8.0CNA v3.10.6%2026-04-22Fix
CVE-2026-5767SlideShowPro SC WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22
CVE-2026-5750Insecure direct object reference (IDOR) vulnerability in Fullstep7.6CNA v4.00.4%2026-04-22Fix
CVE-2026-5749Inadequate access control vulnerability in Fullstep8.7CNA v4.00.4%2026-04-22Fix
CVE-2026-5748Text Snippets WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22
CVE-2026-5398FreeBSD kernel use-after-free bug in the TIOCNOTTY handler8.4CISA ADP v3.10.2%2026-04-22Fix
CVE-2026-5377Incorrect authorization in GitLab4.3CNA v3.10.4%2026-04-22Fix
CVE-2026-5262Improper neutralization of input during web page generation (cross-site scripting) in GitLab8.0CNA v3.10.4%2026-04-22Fix
CVE-2026-4922Cross-site request forgery (CSRF) in GitLab8.1CNA v3.10.3%2026-04-22Fix
CVE-2026-4353CI HUB Connector WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22Fix
CVE-2026-4280Breaking News WP WordPress plugin missing authorization authenticated local file inclusion/Read6.5CNA v3.10.8%2026-04-22
CVE-2026-4279Bread and Butter: Content Gating for Verified Leads WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22Fix
CVE-2026-4142Sentence To SEO (keywords, description and tags) WordPress plugin stored cross-site scripting4.4CNA v3.10.4%2026-04-22
CVE-2026-4140Ni WooCommerce Order Export WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-04-22
CVE-2026-4139mCatFilter WordPress plugin cross-site request forgery via compute_post function4.3CNA v3.10.2%2026-04-22
CVE-2026-4138DX Unanswered Comments WordPress plugin cross-site request forgery via settings update4.3CNA v3.10.2%2026-04-22Fix
CVE-2026-4133TextP2P Texting Widget WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-04-22Fix
CVE-2026-4132HTTP Headers WordPress plugin external control of file name or path to RCE7.2CNA v3.11.6%2026-04-22Fix
CVE-2026-4131WP Responsive Popup + Optin WordPress plugin cross-site request forgery6.1CNA v3.10.2%2026-04-22
CVE-2026-4128TP Restore Categories And Taxonomies WordPress plugin missing authorization4.3CNA v3.10.3%2026-04-22
CVE-2026-4126Table Manager WordPress plugin sensitive information exposure4.3CNA v3.10.4%2026-04-22Fix
CVE-2026-4125WPMK Block WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22
CVE-2026-4121Kcaptcha WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-04-22
CVE-2026-4119Create DB Tables WordPress plugin authorization bypass9.1CNA v3.10.9%2026-04-22
CVE-2026-4118tmarek Call To Action plugin settings update handler cross-site request forgery4.3CNA v3.10.2%2026-04-22
CVE-2026-4117CalJ WordPress plugin arbitrary settings modification via save-obtained-key action5.3CNA v3.10.4%2026-04-22Fix
CVE-2026-4090Inquiry cart WordPress plugin cross-site request forgery via settings form6.1CNA v3.10.2%2026-04-22
CVE-2026-4089Twittee Text Tweet WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22Fix
CVE-2026-4088Switch CTA Box WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-22
CVE-2026-4085Easy Social Photos Gallery WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22
CVE-2026-4082ER Swiffy Insert WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22
CVE-2026-4076Slider Bootstrap Carousel WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-22
CVE-2026-4074Quran Live Multilanguage WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-04-22
CVE-2026-3837Frappe Framework Stored DOM XSS in multiple Field Formatters5.4v3.10.3%2026-04-22
CVE-2026-3673Frappe Framework Stored DOM XSS in Tag Pill Renderer5.4v3.10.3%2026-04-22
CVE-2026-3362Short Comment Filter WordPress plugin stored cross-site scripting4.4CNA v3.10.4%2026-04-22
CVE-2026-3254Improper restriction of rendered UI layers or frames in GitLab3.5CNA v3.10.3%2026-04-22Fix
CVE-2026-2719Private WP suite WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-04-22
CVE-2026-2717HTTP Headers WordPress plugin authenticated (Administrator+) CRLF injection via Custom Header Values5.5CNA v3.10.6%2026-04-22
CVE-2026-2714Institute Management WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-04-22
CVE-2026-1930Emailchef WordPress plugin missing authorization authenticated arbitrary plugin settings deletion4.3CNA v3.10.3%2026-04-22Fix
CVE-2026-1913Gallagher Website Design WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-04-22Fix
CVE-2026-1845Real Estate Pro WordPress plugin authenticated (Admin+) stored cross-site scripting via settings5.5CNA v3.10.2%2026-04-22
CVE-2026-1660Allocation of resources without limits or throttling in GitLab6.5CNA v3.10.4%2026-04-22Fix
CVE-2026-1395Gutentools WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-04-22Fix
CVE-2026-1379HTTP Headers WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-04-22Fix
CVE-2026-0539Local privilege escalation in pcvisit service client8.5CNA v4.00.1%2026-04-22Fix
CVE-2026-41527KDE Kleopatra incorrect control flow6.9CNA v3.10.2%2026-04-21Fix
CVE-2026-41456Bludit CMS reflected XSS via Search plugin5.1CNA v4.02.7%2026-04-21NucleiExploit code
CVE-2026-41331OpenClaw resource consumption via Unauthorized Telegram Audio Preflight Transcription6.9CNA v4.00.5%2026-04-21Fix
CVE-2026-41330OpenClaw Environment Variable Override via Host Exec Policy2.0CNA v4.00.2%2026-04-21Fix
CVE-2026-41329OpenClaw sandbox bypass via Heartbeat Context Inheritance and senderIsOwner Escalation9.0CNA v4.00.5%2026-04-21Fix
CVE-2026-41320Frappe HR has possibility of SQL injection due to improper field sanitization6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-41303OpenClaw authorization bypass in Discord Text Approval commands8.7CNA v4.00.5%2026-04-21Fix
CVE-2026-41302OpenClaw server-side request forgery via Unguarded fetch in Marketplace Plugin Download6.3NVD v3.10.4%2026-04-21Fix
CVE-2026-41301OpenClaw Forged Nostr DM Pairing State Creation via signature verification Bypass6.9CNA v4.00.4%2026-04-21Fix
CVE-2026-41300OpenClaw Preservation of Attacker-Discovered endpoints in Remote Onboarding6.9CNA v4.00.5%2026-04-21Fix
CVE-2026-41299OpenClaw Client Identity spoofing in chat.send Gateway Provenance Guard7.1CNA v4.00.4%2026-04-21Fix
CVE-2026-41298OpenClaw authorization bypass in Session Termination endpoint5.3CNA v4.00.3%2026-04-21Fix
CVE-2026-41297OpenClaw server-side request forgery via Marketplace Plugin Download Redirect4.8CNA v4.00.4%2026-04-21Fix
CVE-2026-41296OpenClaw sandbox escape via TOCTOU Race in Remote FS Bridge readFile8.8CNA v4.00.3%2026-04-21Fix
CVE-2026-41295OpenClaw Untrusted Workspace Channel Shadow code execution during Built-in Channel Setup8.5CNA v4.00.2%2026-04-21Fix
CVE-2026-41294OpenClaw Environment variable injection via CWD .env file8.5CNA v4.00.2%2026-04-21Fix
CVE-2026-41285OpenBSD improper quantity validation4.3CNA v3.10.3%2026-04-21Exploit codeFix
CVE-2026-41194FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable5.4CNA v3.10.2%2026-04-21Fix
CVE-2026-41193FreeScout module installation path traversal9.1CNA v3.10.6%2026-04-21Fix
CVE-2026-41192FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments7.1CNA v3.10.4%2026-04-21Fix
CVE-2026-41191FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes7.1CNA v3.10.3%2026-04-21Fix
CVE-2026-41190FreeScout save_draft endpoint incorrect authorization7.1CNA v3.10.3%2026-04-21Fix
CVE-2026-41189FreeScout thread edit policy incorrect authorization7.1CNA v3.10.3%2026-04-21Fix
CVE-2026-41183FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations4.3CNA v3.10.4%2026-04-21Fix
CVE-2026-41063WWBN AVideo has incomplete fix for (XSS)5.4CNA v3.10.3%2026-04-21
CVE-2026-41062WWBN/AVideo has an incomplete fix for a directory traversal bypass6.5CNA v3.10.9%2026-04-21
CVE-2026-41061WWBN AVideo vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver5.4CNA v3.10.2%2026-04-21
CVE-2026-41060AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL7.7CNA v3.10.4%2026-04-21
CVE-2026-41058AVideo has an incomplete fix for (path traversal) in AVideo8.1CNA v3.10.7%2026-04-21
CVE-2026-41057WWBN AVideo API router origin validation vulnerability7.1CNA v3.10.2%2026-04-21
CVE-2026-41056WWBN AVideo API origin validation vulnerability8.1CNA v3.10.5%2026-04-21
CVE-2026-41055AVideo has an incomplete fix for (SSRF)8.6CNA v3.10.4%2026-04-21Fix
CVE-2026-41039Information disclosure vulnerability in Quantum Networks Router Qn-i-4707.5v3.10.4%2026-04-21Fix
CVE-2026-41038Weak password Policy vulnerability in Quantum Networks Router Qn-i-4708.8v3.10.3%2026-04-21Fix
CVE-2026-41037Missing Rate Limiting vulnerability in Quantum Networks Router Qn-i-4708.8v3.10.3%2026-04-21Fix
CVE-2026-41036Command injection vulnerability in Quantum Networks Router Qn-i-4708.8v3.10.8%2026-04-21Fix
CVE-2026-40946Oxia: OIDC token audience validation bypass via SkipClientIDCheck9.2CNA v4.00.4%2026-04-21Fix
CVE-2026-40945Oxia: Bearer token exposed in debug log messages on authentication failure8.7CNA v4.00.5%2026-04-21Fix
CVE-2026-40944Oxia: TLS CA certificate chain validation fails with multi-certificate PEM bundles6.9CNA v4.00.3%2026-04-21Fix
CVE-2026-40943Oxia: Server crash via race condition in session heartbeat handling8.7CNA v4.00.3%2026-04-21Fix
CVE-2026-40942DSF: Inverted Time Comparison in OIDC JWKS and Token Cache6.3CNA v4.00.5%2026-04-21Fix
CVE-2026-40939DSF: Missing Session Timeout for OIDC Sessions6.8CNA v4.00.2%2026-04-21Fix
CVE-2026-40938Tekton Pipelines git resolver argument injection7.5CNA v3.10.9%2026-04-21Fix
CVE-2026-40935WWBN AVideo CAPTCHA validation vulnerability5.3CNA v3.10.3%2026-04-21
CVE-2026-40933Flowise: Authenticated RCE via MCP Adapters10.0CNA v3.11.3%2026-04-21Fix
CVE-2026-40931Complete Bypass of Patch via Git-Delivered Symlink Poisoning in compressing8.4CNA v3.10.2%2026-04-21Fix
CVE-2026-40929WWBN AVideo comment deletion endpoint cross-site request forgery5.4CNA v3.10.1%2026-04-21
CVE-2026-40928WWBN AVideo comment and category management endpoints cross-site request forgery5.4CNA v3.10.1%2026-04-21
CVE-2026-40927Docmost: XSS in Comments with JavaScript URI5.4CNA v3.10.2%2026-04-21Fix
CVE-2026-40926WWBN AVideo vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update script)7.1CNA v3.10.2%2026-04-21
CVE-2026-40925WWBN AVideo configuration update endpoint cross-site request forgery8.3CNA v3.10.2%2026-04-21
CVE-2026-40924Tekton Pipelines: HTTP Resolver Unbounded Response Body Read enables denial of service6.5CNA v3.10.5%2026-04-21Fix
CVE-2026-40923Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check5.4CNA v3.10.3%2026-04-21Fix
CVE-2026-40911WWBN AVideo YPTSocket WebSocket relay code injection10.0CNA v3.10.9%2026-04-21
CVE-2026-40910frp HTTP vhost routing authentication bypass6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-40909WWBN AVideo locale save endpoint path traversal8.7CNA v3.10.8%2026-04-21
CVE-2026-40908WWBN AVideo has an unauthenticated information disclosure5.3CNA v3.10.4%2026-04-21
CVE-2026-40907WWBN AVideo live restreams list endpoint insecure direct object reference6.5CNA v3.10.4%2026-04-21
CVE-2026-40906Electric: SQL injection via ORDER BY parameter in Shape API10.0CNA v3.10.5%2026-04-21Fix
CVE-2026-40905LinkAce: Password Reset Poisoning via X-Forwarded-host header injection leading to account takeover8.1CNA v3.10.4%2026-04-21Fix
CVE-2026-40903Goshs ArtiPACKED vulnerability GitHub Actions Credential Persistence9.1CNA v3.10.4%2026-04-21Fix
CVE-2026-40895follow-redirects leaks Custom Authentication headers to Cross-Domain Redirect Targets6.9CNA v4.00.8%2026-04-21Fix
CVE-2026-40892PJSIP: Stack buffer overflow in pjsip_auth_create_digest28.1CNA v4.00.6%2026-04-21Fix
CVE-2026-40890Github.com/gomarkdown/markdown: Out-of-bounds read in SmartypantsRenderer7.5CNA v3.10.5%2026-04-21Fix
CVE-2026-40889Frappe HR has improper access control on files6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-40888Frappe HR vulnerable to improper access control6.5CNA v3.00.4%2026-04-21Fix
CVE-2026-40887@vendure/core has a SQL injection9.1CNA v3.12.2%2026-04-21NucleiFix
CVE-2026-40885Goshs: Public collaborator feed leaks .Goshs ACL credentials and enables unauthorized access7.7CNA v4.00.5%2026-04-21Fix
CVE-2026-40884Goshs: Empty-username SFTP password authentication bypass in Goshs9.8CNA v3.10.6%2026-04-21Fix
CVE-2026-40883Goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation6.1CNA v4.00.2%2026-04-21Fix
CVE-2026-40881ZcashFoundation zebrad zebra: Addr/addrv2 deserialization resource exhaustion6.3CNA v4.00.5%2026-04-21Fix
CVE-2026-40880Zcash Foundation Zebra transaction verification cache vulnerability7.2CNA v4.00.4%2026-04-21Fix
CVE-2026-40879Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)7.5CNA v3.10.5%2026-04-21Fix
CVE-2026-40878mailcow-dockerized Login page has reflected parameter injection / Wrong-Context XSS Escaping2.1CNA v4.01.0%2026-04-21NucleiFix
CVE-2026-40876SFTP root escape via prefix-based path validation in Goshs8.7CNA v4.00.6%2026-04-21Fix
CVE-2026-40875mailcow login history IP field stored cross-site scripting7.0CNA v4.00.3%2026-04-21Fix
CVE-2026-40874mailcow Forwarding Hosts deletion API improper access control6.0CNA v4.00.3%2026-04-21Fix
CVE-2026-40873mailcow quarantine attachment filenames stored cross-site scripting8.9CNA v4.00.6%2026-04-21Fix
CVE-2026-40872mailcow Autodiscover logs stored cross-site scripting9.3CNA v4.00.4%2026-04-21Fix
CVE-2026-40871mailcow dockerized quarantine category field SQL injection7.2CNA v3.10.4%2026-04-21Emerging ThreatsFix
CVE-2026-40870Decidim's comments API allows access to all commentable resources7.5CNA v3.10.4%2026-04-21Fix
CVE-2026-40869Decidim amendments can be accepted or rejected by anyone7.5CNA v3.10.3%2026-04-21Fix
CVE-2026-40868kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token8.1CNA v3.10.4%2026-04-21Fix
CVE-2026-40867Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation7.1CNA v4.00.4%2026-04-21
CVE-2026-40866Horilla: Unauthorized Document Overwrite via file upload endpoint8.6CNA v4.00.4%2026-04-21
CVE-2026-40865Horilla employee document viewer insecure direct object reference7.1CNA v4.00.2%2026-04-21
CVE-2026-40706Tuxera NTFS-3G heap-based buffer overflow8.4CNA v3.10.2%2026-04-21Fix
CVE-2026-40614PJSIP: Heap buffer overflow in Opus codec decoding8.5CNA v4.00.4%2026-04-21Fix
CVE-2026-40613Coturn: Misaligned Memory Access in coturn STUN attribute parser (remote DoS on ARM64)7.5CNA v3.11.5%2026-04-21Fix
CVE-2026-40611Lego: Arbitrary file write via path traversal in Webroot HTTP-01 Provider8.8CNA v3.10.5%2026-04-21Fix
CVE-2026-40608DayuanJiang next-ai-draw-io Next AI Draw.io: Unbounded HTTP Body denial of service6.2CNA v3.10.2%2026-04-21Fix
CVE-2026-40606ProxyAuth Addon LDAP injection in mitmproxy4.8CNA v3.10.3%2026-04-21Fix
CVE-2026-40604ClearanceKit opfilter system extension protection mechanism failure8.2CNA v4.00.2%2026-04-21Fix
CVE-2026-40602home-assistant-ecosystem home-assistant-cli hass-cli: Handling of user-supplied Jinja2 templates5.6CNA v3.10.1%2026-04-21Fix
CVE-2026-40599ClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlist8.4CNA v4.00.1%2026-04-21Fix
CVE-2026-40594pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto header spoofing4.8CNA v3.10.2%2026-04-21Fix
CVE-2026-40592FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply5.9CNA v3.10.4%2026-04-21Fix
CVE-2026-40591FreeScout phone conversation creation insecure direct object reference7.1CNA v3.10.3%2026-04-21Fix
CVE-2026-40590FreeScout customer AJAX create insecure direct object reference4.3CNA v3.10.3%2026-04-21Fix
CVE-2026-40589FreeScout customer edit insecure direct object reference7.6CNA v3.10.4%2026-04-21Fix
CVE-2026-40588blueprintUE: Authenticated Password Change Does not Verify Current Password8.1CNA v3.10.4%2026-04-21Fix
CVE-2026-40587blueprintUE: Active Sessions are not Invalidated after Password Change or Reset6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-40586blueprintUE: Login endpoint has no Rate Limiting, Lockout, or brute-force Protection7.5CNA v3.10.5%2026-04-21Fix
CVE-2026-40585blueprintUE: Password Reset Tokens have no Expiry window7.4CNA v3.10.3%2026-04-21Fix
CVE-2026-40584RansomLook generic API information disclosure6.9CNA v4.00.4%2026-04-21Fix
CVE-2026-40583UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt8.8CNA v4.00.6%2026-04-21
CVE-2026-40576Improper limitation of a pathname to a restricted directory (path traversal) in excel-mcp-server9.4CNA v3.10.6%2026-04-21Fix
CVE-2026-40575OAuth2 Proxy has an authentication bypass via X-Forwarded-Uri header spoofing9.1CNA v3.10.7%2026-04-21Fix
CVE-2026-40574OAuth2 Proxy has an authorization bypass in Email Domain Validation6.8CNA v3.10.3%2026-04-21Fix
CVE-2026-40570FreeScout load_customer_info action missing authorization5.7CNA v4.00.4%2026-04-21Fix
CVE-2026-40569FreeScout's mass assignment in Mailbox Connection settings enables Silent Email Exfiltration9.0CNA v3.10.5%2026-04-21Fix
CVE-2026-40568FreeScout vulnerable to XSS via Mailbox Signature due to Incomplete HTML Sanitization8.5CNA v3.10.4%2026-04-21Fix
CVE-2026-40567FreeScout outgoing email signature variables improper output encoding5.8CNA v3.10.4%2026-04-21Fix
CVE-2026-40566FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test endpoints4.1CNA v3.10.4%2026-04-21Fix
CVE-2026-40565FreeScout has stored XSS / CSS injection via linkify Unescaped URL in Anchor href6.1CNA v3.10.3%2026-04-21Fix
CVE-2026-40520FreePBX api module command injection via GraphQL8.8v3.12.4%2026-04-21
CVE-2026-40498FreeScout has authentication bypass and information disclosure in SystemController via /system/cron8.9CNA v4.00.7%2026-04-21Fix
CVE-2026-40497FreeScout vulnerable to CSS injection8.1CNA v3.10.4%2026-04-21Fix
CVE-2026-40496FreeScout attachment download token predictable identifiers8.8CNA v4.00.5%2026-04-21Fix
CVE-2026-40372Microsoft ASP.NET Core elevation of privilege9.1CNA v3.10.8%2026-04-21Fix
CVE-2026-40279bacnet-stack BACnet Stack: Undefined-behavior signed left shift in `decode_signed32`3.7CNA v3.10.3%2026-04-21Fix
CVE-2026-40264OpenBao's Token Store allows Cross-Namespace Renewal, Revocation2.0CNA v4.00.4%2026-04-21Fix
CVE-2026-40250OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of)8.4CNA v4.00.2%2026-04-21Fix
CVE-2026-40244OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic8.4CNA v4.00.2%2026-04-21Fix
CVE-2026-40161Linux Foundation Tekton Pipelines git resolver API mode information disclosure7.7CNA v3.10.4%2026-04-21Fix
CVE-2026-40050CrowdStrike LogScale unauthenticated path traversal9.8CNA v3.10.8%2026-04-21Fix
CVE-2026-40045OpenClaw Cleartext Credential Transmission via Unencrypted WebSocket Gateway endpoints5.9CNA v4.00.2%2026-04-21Fix
CVE-2026-39973Apktool: Path traversal to arbitrary file write7.1CNA v3.10.2%2026-04-21Exploit codeFix
CVE-2026-39946OpenBao allows SQL injection in PostgreSQL database secrets engine4.6CNA v4.00.4%2026-04-21Fix
CVE-2026-39886OpenEXR has HTJ2K Signed integer overflow in ht_undo_impl5.3CNA v3.10.4%2026-04-21Fix
CVE-2026-39866Lawnchair vulnerable to command injection via unquoted workflow dispatch input in release_update.yml7.4CNA v4.03.0%2026-04-21Exploit code
CVE-2026-39861anthropics claude-code claude Code: Sandbox escape7.7CNA v4.00.8%2026-04-21Fix
CVE-2026-39467Responsive Slider by MetaSlider WordPress plugin PHP object injection7.2CNA v3.10.5%2026-04-21Fix
CVE-2026-39396OpenBao has decompression bomb via Unbounded Copy in OCI Plugin Extraction (DoS)3.1CNA v3.10.3%2026-04-21Fix
CVE-2026-39388OpenBao's Certificate Authentication allows Token Renewal with Different Certificate2.0CNA v4.00.1%2026-04-21Fix
CVE-2026-39386Neko has Self-service privilege escalation for Authenticated Users8.8CNA v3.10.6%2026-04-21Fix
CVE-2026-39378nbconvert has an arbitrary file read via path traversal in HTMLExporter Image Embedding6.5CNA v3.10.5%2026-04-21Fix
CVE-2026-39377nbconvert has an arbitrary file write via path traversal in Cell Attachment Filenames6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-39320signalk-server signal K Server has an unauthenticated regular expression denial of service7.5CNA v3.10.7%2026-04-21Fix
CVE-2026-38835Tenda W30E command injection9.8CISA ADP v3.12.6%2026-04-21
CVE-2026-38834Tenda W30E command injection7.3CISA ADP v3.11.6%2026-04-21
CVE-2026-37748Sanjay1313 Visitor Management System unrestricted file upload7.2CISA ADP v3.10.9%2026-04-21Exploit code
CVE-2026-35588Glances has CQL injection in its Cassandra Export module via Unsanitized Config Values6.3CNA v3.10.2%2026-04-21Fix
CVE-2026-35587Glances IP plugin has SSRF via public_api that leads to credential leakage7.3CNA v4.00.5%2026-04-21Fix
CVE-2026-35570OpenClaude has sandbox bypass via Early-Exit logic flaw that allows path traversal8.4CNA v3.10.2%2026-04-21Exploit codeFix
CVE-2026-35451Twenty: Stored XSS via BlockNote FileBlock5.7CNA v3.10.4%2026-04-21Fix
CVE-2026-35252Oracle Security Service C Oracle SSL API component unauthorized data access6.4CNA v3.10.3%2026-04-21Fix
CVE-2026-35251Oracle VM VirtualBox Core component takeover7.5CNA v3.10.1%2026-04-21Fix
CVE-2026-35250Oracle VM VirtualBox Core component denial of service2.3CNA v3.10.2%2026-04-21Fix
CVE-2026-35249Oracle VM VirtualBox Core component unauthorized data modification3.2CNA v3.10.2%2026-04-21Fix
CVE-2026-35248Oracle VM VirtualBox Core component unauthorized data modification5.0CNA v3.10.1%2026-04-21Fix
CVE-2026-35247Oracle VM VirtualBox Core component unauthorized data access6.0CNA v3.10.2%2026-04-21Fix
CVE-2026-35246Oracle VM VirtualBox Core component takeover7.5CNA v3.10.1%2026-04-21Fix
CVE-2026-35245Oracle VM VirtualBox Core component denial of service7.5CNA v3.10.4%2026-04-21Fix
CVE-2026-35244Oracle Hyperion Infrastructure Technology unauthorized data modification5.2CNA v3.10.3%2026-04-21Fix
CVE-2026-35243Oracle Application Development Framework (ADF) ADF Faces component takeover7.8CNA v3.10.2%2026-04-21Fix
CVE-2026-35242Oracle VM VirtualBox Core component takeover7.5CNA v3.10.1%2026-04-21Fix
CVE-2026-35241Oracle PeopleSoft Enterprise CS Student Records Research Tracking component unauthorized data access5.7CNA v3.10.3%2026-04-21Fix
CVE-2026-35240Oracle MySQL Server Optimizer component denial of service4.9CNA v3.10.4%2026-04-21Fix
CVE-2026-35239Oracle MySQL Server DML component denial of service4.9CNA v3.10.4%2026-04-21Fix
CVE-2026-35238Oracle MySQL Server InnoDB component denial of service4.9CNA v3.10.4%2026-04-21Fix
CVE-2026-35237Oracle MySQL Server InnoDB component denial of service4.9CNA v3.10.4%2026-04-21Fix
CVE-2026-35236Oracle MySQL Server InnoDB component denial of service4.9CNA v3.10.4%2026-04-21Fix
CVE-2026-35235Oracle MySQL Server GIS component denial of service4.9CNA v3.10.4%2026-04-21Fix
CVE-2026-35234Oracle MySQL Server Partition component denial of service4.9CNA v3.10.4%2026-04-21Fix
CVE-2026-35232Oracle Fusion Middleware improper access control5.4CNA v3.10.2%2026-04-21Fix
CVE-2026-35231Oracle Financial Services Transaction Filtering User interface component unauthorized data access7.5CNA v3.10.4%2026-04-21Fix
CVE-2026-35230Oracle VM VirtualBox Core component takeover7.5CNA v3.10.1%2026-04-21Fix
CVE-2026-35229Oracle Database Server unauthorized access7.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34839Glances vulnerable to Cross-Origin information disclosure7.7CNA v4.00.5%2026-04-21Fix
CVE-2026-34325Oracle Financial Services Analytical Applications Infrastructure unauthorized data access6.8CNA v3.10.1%2026-04-21Fix
CVE-2026-34324Oracle Life Sciences InForm App Server component unauthorized data modification6.5CNA v3.10.3%2026-04-21Fix
CVE-2026-34323Oracle Life Sciences InForm IDM Authentication component unauthorized data modification6.3CNA v3.10.2%2026-04-21Fix
CVE-2026-34321Oracle Financial Services Analytical Applications Infrastructure unauthorized data access4.8CNA v3.10.3%2026-04-21Fix
CVE-2026-34320Oracle Financial Services Customer Screening User interface component unauthorized data access7.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34319Oracle MySQL Shell Core client component denial of service5.0CNA v3.10.1%2026-04-21Fix
CVE-2026-34318Oracle MySQL Shell Core client component unauthorized data access5.8CNA v3.10.3%2026-04-21Fix
CVE-2026-34317Oracle MySQL Shell Core client component denial of service5.0CNA v3.10.1%2026-04-21Fix
CVE-2026-34315Oracle WebLogic Server Web services component unauthorized data modification6.5CNA v3.10.3%2026-04-21Fix
CVE-2026-34314Oracle Financial Services Analytical Applications Infrastructure unauthorized data access6.8CNA v3.10.3%2026-04-21Fix
CVE-2026-34313Oracle Financial Services Analytical Applications Infrastructure unauthorized data access6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34312Oracle Database Server improper access control2.4CNA v3.10.3%2026-04-21Fix
CVE-2026-34310Oracle Financial Services Analytical Applications Infrastructure unauthorized data access7.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34309Oracle PeopleSoft Enterprise PeopleTools Security component unauthorized data access8.1CNA v3.10.4%2026-04-21Fix
CVE-2026-34308Oracle MySQL Server JSON component denial of service6.5CNA v3.10.4%2026-04-21Exploit codeFix
CVE-2026-34307Oracle PeopleSoft Enterprise PeopleTools Workflow component unauthorized data modification5.4CNA v3.10.2%2026-04-21Fix
CVE-2026-34306Oracle PeopleSoft Enterprise FIN Project Costing Projects component unauthorized data access6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34305Oracle WebLogic Server Web services component unauthorized data access7.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34304Oracle MySQL Server InnoDB component denial of service4.9CNA v3.10.5%2026-04-21Fix
CVE-2026-34303Oracle MySQL Server Optimizer component denial of service6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34302Oracle E-Business Suite Workflow Loader component unauthorized data modification5.5CNA v3.10.3%2026-04-21Fix
CVE-2026-34301Oracle PeopleSoft Enterprise FIN Maintenance Management unauthorized data access6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34300Oracle PeopleSoft Enterprise FIN Contracts unauthorized data access6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34299Oracle PeopleSoft Enterprise FIN Maintenance Management unauthorized data access6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34298Oracle E-Business Suite Applications Framework unauthorized data modification4.7CNA v3.10.3%2026-04-21Fix
CVE-2026-34297Oracle E-Business Suite HCM Common Architecture unauthorized data access7.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34296Oracle Agile Product Lifecycle Management for Process information disclosure4.3CNA v3.10.3%2026-04-21Fix
CVE-2026-34295Oracle PeopleSoft Enterprise SCM Purchasing unauthorized data access6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34294Oracle Identity Manager Connector unauthorized data modification5.9CNA v3.10.2%2026-04-21Fix
CVE-2026-34293Oracle MySQL Server DML component denial of service4.9CNA v3.10.5%2026-04-21Fix
CVE-2026-34292Oracle WebLogic Server Core component takeover7.2CNA v3.10.5%2026-04-21Fix
CVE-2026-34291Oracle HTTP Server Core component unauthorized data access8.7CNA v3.10.3%2026-04-21Fix
CVE-2026-34290Oracle Identity Manager Connector Core component denial of service7.5CNA v3.10.5%2026-04-21Fix
CVE-2026-34289Oracle Identity Manager Connector Core component unauthorized data access5.9CNA v3.10.3%2026-04-21Fix
CVE-2026-34288Oracle Identity Manager Connector Core component unauthorized data access5.9CNA v3.10.3%2026-04-21Fix
CVE-2026-34287Oracle Identity Manager Connector Core component unauthorized data access9.1CNA v3.10.4%2026-04-21Fix
CVE-2026-34286Oracle Identity Manager Connector Core component unauthorized data access9.1CNA v3.10.4%2026-04-21Fix
CVE-2026-34285Oracle Identity Manager Connector Core component unauthorized data access9.1CNA v3.10.4%2026-04-21Fix
CVE-2026-34284Oracle Business Process Management Suite unauthorized data modification6.1CNA v3.10.2%2026-04-21Fix
CVE-2026-34283Oracle Identity Manager Identity console component unauthorized data modification6.1CNA v3.10.2%2026-04-21Fix
CVE-2026-34282Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition denial of service7.5CNA v3.10.9%2026-04-21Fix
CVE-2026-34281Oracle Solaris Kernel component denial of service6.5CNA v3.10.2%2026-04-21Fix
CVE-2026-34280Oracle PeopleSoft Enterprise HCM Human Resources unauthorized data access6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34279Oracle Enterprise Manager Base Platform Event Management component takeover9.1CNA v3.10.5%2026-04-21Fix
CVE-2026-34278Oracle MySQL Server Optimizer component denial of service4.9CNA v3.10.5%2026-04-21Fix
CVE-2026-34277Oracle PeopleSoft Enterprise PeopleTools Fluid Core component unauthorized data modification6.6CNA v3.10.3%2026-04-21Fix
CVE-2026-34276Oracle MySQL Server Group Replication plugin component denial of service6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34275Oracle E-Business Suite Advanced Inbound Telephony Setup and Administration component takeover9.8CNA v3.10.5%2026-04-21Fix
CVE-2026-34274Oracle E-Business Suite Configurator User interface component unauthorized data modification6.1CNA v3.10.2%2026-04-21Fix
CVE-2026-34273Oracle GoldenGate information disclosure5.3CNA v3.10.3%2026-04-21Fix
CVE-2026-34272Oracle MySQL Server Optimizer component denial of service6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34271Oracle MySQL Server Group Replication plugin component denial of service6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34270Oracle MySQL Server Group Replication plugin component denial of service6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-34269Oracle PeopleSoft Enterprise PeopleTools portal component unauthorized data modification6.1CNA v3.10.2%2026-04-21Fix
CVE-2026-34268Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition information disclosure2.9CNA v3.10.1%2026-04-21Fix
CVE-2026-34267Oracle MySQL Server Optimizer component denial of service4.9CNA v3.10.5%2026-04-21Fix
CVE-2026-34266Oracle PeopleSoft Enterprise HCM Absence Management unauthorized data access6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-33813Panic when decoding large WEBP Image on 32-bit platforms in golang.org/x/Image7.5CISA ADP v3.10.6%2026-04-21Fix
CVE-2026-33812Excessive memory allocation when decoding malicious SFNT in golang.org/x/Image6.1CISA ADP v3.10.2%2026-04-21Fix
CVE-2026-33519Incorrect privilege assignment in Portal for ArcGIS9.8CNA v3.10.5%2026-04-21Fix
CVE-2026-33518Incorrect privilege assignment in Portal for ArcGIS9.8CNA v3.10.5%2026-04-21Fix
CVE-2026-32147Erlang OTP SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT5.3CNA v4.00.4%2026-04-21Fix
CVE-2026-31370Information leak vulnerability in Honor E6.3CNA v3.10.2%2026-04-21
CVE-2026-31369Honor PcManager privilege escalation3.2CNA v3.10.1%2026-04-21
CVE-2026-31368Honor AIAssistant privilege escalation7.8CNA v3.10.2%2026-04-21
CVE-2026-31019Dolibarr ERP CRM OS command injection8.8CISA ADP v3.11.0%2026-04-21
CVE-2026-31018Dolibarr allows code injection through its Website module8.8CISA ADP v3.10.5%2026-04-21
CVE-2026-31014Dovestones AD Self Update cross-site request forgery6.3CISA ADP v3.10.1%2026-04-21
CVE-2026-31013Dovestones AD Phonebook cross-site scripting6.1CISA ADP v3.10.3%2026-04-21
CVE-2026-30452Textpattern missing authorization6.5CISA ADP v3.10.3%2026-04-21Fix
CVE-2026-29644XiangShan PMA CSR write-enable gating improper access control5.3CISA ADP v3.10.1%2026-04-21
CVE-2026-29179October: Editor Sub-permission bypass for Asset and Blueprint File Operations3.3CNA v3.10.2%2026-04-21Fix
CVE-2026-27937October: Reflected XSS via DataTable form widget3.1CNA v3.10.2%2026-04-21Fix
CVE-2026-26274October: Safe Mode Bypass via Twig Database Write Operations6.6CNA v3.10.4%2026-04-21Fix
CVE-2026-26067October: Safe Mode Bypass via CSS Preprocessor Compilers4.9CNA v3.10.4%2026-04-21Fix
CVE-2026-25542Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching6.5CNA v3.10.4%2026-04-21Fix
CVE-2026-24189NVIDIA CUDA-Q out-of-bounds read8.2CNA v3.10.3%2026-04-21Fix
CVE-2026-24177NVIDIA KAI Scheduler missing authentication7.7CNA v3.10.2%2026-04-21Fix
CVE-2026-24176NVIDIA KAI Scheduler incorrect authorization4.3CNA v3.10.2%2026-04-21Fix
CVE-2026-22751Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions4.8CNA v3.10.1%2026-04-21Fix
CVE-2026-22021Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition denial of service5.3CNA v3.10.3%2026-04-21Fix
CVE-2026-22019Oracle PeopleSoft Enterprise HCM Shared Components unauthorized data modification5.4CNA v3.10.2%2026-04-21Fix
CVE-2026-22018Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition denial of service3.7CNA v3.10.3%2026-04-21Fix
CVE-2026-22017Oracle MySQL Server Optimizer component denial of service6.5CNA v3.10.3%2026-04-21Fix
CVE-2026-22016Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition unauthorized data access7.5CNA v3.10.7%2026-04-21Fix
CVE-2026-22015Oracle MySQL Server Information Schema component information disclosure4.3CNA v3.10.2%2026-04-21Fix
CVE-2026-22014Oracle E-Business Suite User Management unauthorized data modification3.8CNA v3.10.2%2026-04-21Fix
CVE-2026-22013Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition unauthorized data access5.3CNA v3.10.3%2026-04-21Fix
CVE-2026-22011Oracle E-Business Suite Applications DBA ADPatch component takeover7.6CNA v3.10.3%2026-04-21Fix
CVE-2026-22010Oracle Financial Services Analytical Applications Infrastructure unauthorized data access7.5CNA v3.10.3%2026-04-21Exploit codeFix
CVE-2026-22009Oracle MySQL Server Optimizer component denial of service6.5CNA v3.10.3%2026-04-21Fix
CVE-2026-22008Oracle Java SE execution with unnecessary privileges3.7CNA v3.10.2%2026-04-21Fix
CVE-2026-22007Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition information disclosure2.9CNA v3.10.1%2026-04-21Fix
CVE-2026-22006Oracle PeopleSoft Enterprise HCM Human Resources unauthorized data modification5.4CNA v3.10.2%2026-04-21Fix
CVE-2026-22005Oracle MySQL Server Optimizer component denial of service4.9CNA v3.10.3%2026-04-21Fix
CVE-2026-22004Oracle MySQL Server InnoDB component denial of service4.9CNA v3.10.3%2026-04-21Fix
CVE-2026-22003Oracle Java SE, Oracle GraalVM Enterprise Edition Hotspot component unauthorized data modification6.0CNA v3.10.1%2026-04-21Fix
CVE-2026-22002Oracle MySQL Server Optimizer component denial of service4.9CNA v3.10.3%2026-04-21Exploit codeFix
CVE-2026-22001Oracle MySQL Server Information Schema component information disclosure2.7CNA v3.10.3%2026-04-21Fix
CVE-2026-21999Oracle Database Server unauthorized access5.3CNA v3.10.2%2026-04-21Fix
CVE-2026-21998Oracle MySQL Server Optimizer component denial of service4.9CNA v3.10.3%2026-04-21Fix
CVE-2026-21997Oracle Life Sciences Empirica Signal Common Core component unauthorized data modification8.5CNA v3.10.2%2026-04-21Fix
CVE-2026-21571Atlassian Bamboo Data Center OS command injection9.4CNA v4.01.3%2026-04-21Fix
CVE-2026-6832Nesquena Hermes WebUI arbitrary file deletion via Unvalidated session_id7.2CNA v4.00.7%2026-04-21Fix
CVE-2026-6830Nesquena Hermes WebUI Environment variable credential leakage via Profile Switch4.8CNA v4.00.2%2026-04-21
CVE-2026-6829nesquena hermes-webui arbitrary Workspace Directory Access5.3CNA v4.00.4%2026-04-21Fix
CVE-2026-6823HKUDS OpenHarness insecure default Remote Channel Allowlist8.3CNA v4.00.6%2026-04-21Fix
CVE-2026-6819HKUDS OpenHarness Plugin Management Command Exposure8.7CNA v4.00.5%2026-04-21Fix
CVE-2026-6799Comfast CF-N1-S endpoint mbox-config command injection5.3CNA v4.02.4%2026-04-21
CVE-2026-6797Sanluan PublicCMS DocToHtmlUtils.java ZipSecureFile.setMinflateRatio resource consumption5.3CNA v4.00.5%2026-04-21
CVE-2026-6796Sanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in file5.3CNA v4.00.2%2026-04-21
CVE-2026-6786Mozilla memory safety bugs fixed in Firefox ESR, Thunderbird ESR, Firefox 150 and Thunderbird 1507.5CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6785Mozilla Firefox memory safety bugs7.5CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6784Mozilla memory safety bugs fixed in Firefox 150 and Thunderbird 1507.5CISA ADP v3.10.4%2026-04-21Fix
CVE-2026-6783Mozilla Firefox and Thunderbird audio and video playback integer overflow5.3v3.10.2%2026-04-21Fix
CVE-2026-6782Mozilla Firefox information disclosure in the IP Protection component7.5CISA ADP v3.10.4%2026-04-21Fix
CVE-2026-6781Mozilla Firefox denial of service in the Audio/Video: Playback component7.5CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6780Mozilla Firefox denial of service in the Audio/Video: Playback component7.5CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6779Mozilla Firefox other issue in the JavaScript Engine component5.3CISA ADP v3.10.3%2026-04-21Fix
CVE-2026-6778Mozilla Firefox invalid pointer in the Audio/Video: Playback component5.3CISA ADP v3.10.4%2026-04-21Fix
CVE-2026-6777Mozilla Firefox other issue in the Networking: DNS component5.3CISA ADP v3.10.2%2026-04-21Fix
CVE-2026-6776Mozilla Firefox incorrect boundary conditions in the WebRTC: Networking component7.8CISA ADP v3.10.2%2026-04-21Fix
CVE-2026-6775Mozilla Firefox incorrect boundary conditions in the WebRTC component5.3CISA ADP v3.10.3%2026-04-21Fix
CVE-2026-6774Mozilla Firefox mitigation bypass in the DOM: Security component5.4CISA ADP v3.10.3%2026-04-21Fix
CVE-2026-6773Mozilla Firefox denial of service due to integer overflow in the Graphics: WebGPU component7.5CISA ADP v3.10.6%2026-04-21Fix
CVE-2026-6772Mozilla Firefox incorrect boundary conditions in the Libraries component in NSS7.5CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6771Mozilla Firefox mitigation bypass in the DOM: Security component9.8CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6770Mozilla Firefox other issue in the Storage: IndexedDB component6.5CISA ADP v3.10.4%2026-04-21Exploit codeFix
CVE-2026-6769Mozilla Firefox privilege escalation in the Debugger component8.8CISA ADP v3.10.4%2026-04-21Fix
CVE-2026-6768Mozilla Firefox Mitigation bypass in the Networking: Cookies component9.8CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6767Mozilla Firefox other issue in the Libraries component in NSS5.3CISA ADP v3.10.4%2026-04-21Fix
CVE-2026-6766Mozilla Firefox incorrect boundary conditions in the Libraries component in NSS7.5CISA ADP v3.10.4%2026-04-21Fix
CVE-2026-6765Mozilla Firefox information disclosure in the Form Autofill component5.3CISA ADP v3.10.4%2026-04-21Fix
CVE-2026-6764Mozilla Firefox incorrect boundary conditions in the DOM: Device Interfaces component6.5CISA ADP v3.10.4%2026-04-21Fix
CVE-2026-6763Mozilla Firefox Mitigation bypass in the File Handling component6.5CISA ADP v3.10.3%2026-04-21Fix
CVE-2026-6762Mozilla Firefox spoofing issue in the DOM: Core and HTML component6.3CISA ADP v3.10.3%2026-04-21Fix
CVE-2026-6761Mozilla Firefox privilege escalation in the Networking component8.8CISA ADP v3.10.4%2026-04-21Fix
CVE-2026-6760Mozilla Firefox Mitigation bypass in the Networking: Cookies component9.8CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6759Mozilla Firefox use-after-free in the Widget: Cocoa component7.5CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6758Mozilla Firefox use-after-free in the JavaScript: WebAssembly component7.5CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6757Mozilla Firefox invalid pointer in the JavaScript: WebAssembly component6.3CISA ADP v3.10.3%2026-04-21Fix
CVE-2026-6756Mozilla Mitigation bypass in Firefox for Android7.5CISA ADP v3.10.4%2026-04-21Fix
CVE-2026-6755Mozilla Firefox mitigation bypass in the DOM: PostMessage component6.5CISA ADP v3.10.2%2026-04-21Fix
CVE-2026-6754Mozilla Firefox use-after-free in the JavaScript Engine component7.5CISA ADP v3.10.6%2026-04-21Fix
CVE-2026-6753Mozilla Firefox incorrect boundary conditions in the WebRTC component7.3CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6752Mozilla Firefox incorrect boundary conditions in the WebRTC component7.3CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6751Mozilla Firefox uninitialized memory in the Audio/Video: Web Codecs component7.3CISA ADP v3.10.5%2026-04-21Fix
CVE-2026-6750Mozilla Firefox privilege escalation in the Graphics: WebRender component8.8CISA ADP v3.10.6%2026-04-21Fix
CVE-2026-6749Mozilla Firefox Graphics: Canvas2D component information disclosure7.5CISA ADP v3.10.6%2026-04-21Fix
CVE-2026-6748Mozilla Firefox uninitialized memory in the Audio/Video: Web Codecs component9.8CISA ADP v3.10.6%2026-04-21Fix
CVE-2026-6747Mozilla Firefox use-after-free in the WebRTC component7.5CISA ADP v3.10.6%2026-04-21Fix
CVE-2026-6746Mozilla Firefox use-after-free in the DOM: Core and HTML component7.5CISA ADP v3.10.6%2026-04-21Fix
CVE-2026-6745Bagisto Custom scripts cross-site scripting5.1CNA v4.00.3%2026-04-21
CVE-2026-6744Bagisto Downloadable Link copy server-side request forgery5.3CNA v4.00.3%2026-04-21
CVE-2026-6743WebSystems WebTOTUM Calendar cross-site scripting5.1CNA v4.00.3%2026-04-21Fix
CVE-2026-6712Website LLMs.txt WordPress plugin authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2026-04-21Fix
CVE-2026-6711Website LLMs.txt WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2026-04-21Fix
CVE-2026-6703Responsive Blocks WordPress plugin missing authorization authenticated arbitrary modification4.3CNA v3.10.4%2026-04-21Fix
CVE-2026-6675Responsive Blocks WordPress plugin unauthenticated open email Relay via REST API email_to parameter5.3CNA v3.10.4%2026-04-21Fix
CVE-2026-6674Plugin: CMS für Motorrad Werkstätten WordPress plugin SQL injection6.5CNA v3.10.4%2026-04-21
CVE-2026-6553TYPO3 CMS Stores Cleartext Password in User settings module7.3CNA v4.00.3%2026-04-21Fix
CVE-2026-6058Zyxel WRE6505 v2 firmware denial of service4.5CNA v3.10.2%2026-04-21
CVE-2026-5965NewSoft｜NewSoftOA OS command injection9.3CNA v4.02.6%2026-04-21Fix
CVE-2026-5921GitHub Enterprise Server notebook rendering service server-side request forgery8.9CNA v4.00.6%2026-04-21Fix
CVE-2026-5845GitHub Enterprise Server scoped user-to-server improper authorization7.2CNA v4.00.5%2026-04-21Fix
CVE-2026-5789Search path without quotes in CivetWeb7.8v3.10.2%2026-04-21Fix
CVE-2026-5652Authorization bypass through user-controlled key in Crafty Controller9.0CNA v3.10.5%2026-04-21
CVE-2026-5512GitHub Enterprise Server mobile upload policy API information disclosure5.3CNA v4.00.5%2026-04-21Fix
CVE-2026-4296GitHub Enterprise Server OAuth redirect URI validation vulnerability7.5CNA v4.00.7%2026-04-21Fix
CVE-2026-3317Reflected cross-site scripting in Navigate CMS application5.1CNA v4.00.5%2026-04-21Fix
CVE-2026-3307GitHub Enterprise Server secret scanning push protection improper authorization5.3CNA v4.00.5%2026-04-21Fix
CVE-2026-3298Python CPython out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into when8.8CNA v4.00.6%2026-04-21Fix
CVE-2026-1354Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth. Once paired, an attacker can utilize over-the-air firmware updating functionality to potentially upload malicious firmware to the motorcycle. The motorcycle must first5.9CNA v4.00.1%2026-04-21Fix
CVE-2026-1089User‑Controlled HTTP header in Fortra's GoAnywhere MFT allows arbitrary DNS Lookups6.5CNA v3.10.2%2026-04-21Fix
CVE-2026-0972HTML injection possible in system generated emails in Fortra's GoAnywhere MFT5.4CNA v3.10.2%2026-04-21Fix
CVE-2026-0971GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout4.3CNA v3.10.2%2026-04-21Fix
CVE-2026-41445KissFFT integer overflow heap buffer overflow via kiss_fftndr_alloc8.7CNA v4.00.5%2026-04-20Fix
CVE-2026-41389OpenClaw arbitrary file read via Unvalidated Tool-Result Media Paths6.3CNA v4.00.4%2026-04-20Fix
CVE-2026-41282Nuclei: Environment variable disclosure via Response-Derived DSL Expressions7.5v3.10.3%2026-04-20Fix
CVE-2026-41245Junrar: Path traversal (Zip-Slip) via Sibling Directory Name Prefix5.9CNA v3.10.5%2026-04-20Fix
CVE-2026-40896OpenProject has Cross-Project Meeting Agenda Item injection via Unscoped Section Lookup6.5CNA v3.10.2%2026-04-20Fix
CVE-2026-40488OpenMage magento-lts custom option file upload vulnerability8.7CNA v4.01.0%2026-04-20Fix
CVE-2026-40098OpenMage LTS: Cross-user wishlist import leads to private option and file disclosure5.3CNA v4.00.2%2026-04-20Fix
CVE-2026-39918Vvveb code injection via Installation endpoint9.2CNA v4.01.1%2026-04-20Fix
CVE-2026-39454SKYSEA Client View incorrect default permissions8.5CNA v4.00.2%2026-04-20Fix
CVE-2026-39112Apartment Visitors Management System visitor registration form vulnerability5.4CISA ADP v3.10.3%2026-04-20
CVE-2026-39111Apartment Visitors Management System forgot password page SQL injection7.5CISA ADP v3.10.5%2026-04-20
CVE-2026-39110Apartment Visitors Management System forgot password page SQL injection8.2CISA ADP v3.10.5%2026-04-20
CVE-2026-39109Apartment Visitors Management System login page SQL injection9.4CISA ADP v3.10.6%2026-04-20
CVE-2026-35154Dell PowerProtect Data Domain appliances improper privilege management6.3CNA v3.10.1%2026-04-20Fix
CVE-2026-34429Vvveb stored XSS via Media upload and Rename5.1CNA v4.00.5%2026-04-20Fix
CVE-2026-34428Vvveb SSRF via oEmbedProxy8.3CNA v4.00.4%2026-04-20Fix
CVE-2026-34427Vvveb privilege escalation via admin/user/save8.7CNA v4.01.0%2026-04-20Fix
CVE-2026-34403Nginx-UI: Cross-Site WebSocket Hijacking via missing origin validation on all WebSocket endpoints5.5CNA v4.00.2%2026-04-20Fix
CVE-2026-34082Dify has IDOR in deleting someone else's chat conversation5.3CNA v4.00.3%2026-04-20Fix
CVE-2026-33626LMDeploy vulnerable to server-side request forgery (SSRF) via Vision-Language Image Loading7.5CNA v3.11.5%2026-04-20NucleiEmerging ThreatsFix
CVE-2026-33558Apache Kafka, Apache Kafka Clients: Information exposure through Network Client Log Output5.3CISA ADP v3.10.9%2026-04-20Fix
CVE-2026-33557Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication9.1CISA ADP v3.10.9%2026-04-20Fix
CVE-2026-33432Roxy-WI has Pre-authentication LDAP injection that leads to authentication bypass7.7CNA v4.00.6%2026-04-20
CVE-2026-33431Roxy-WI vulnerable to authenticated arbitrary file read via path traversal in Config Version Viewer5.7CNA v4.00.5%2026-04-20Fix
CVE-2026-33031Nginx-UI: Disabled users retain full API access through previously issued bearer tokens8.6CNA v4.00.4%2026-04-20Fix
CVE-2026-32965silex technology SD-330AC SD-330AC and AMC Manager provided by insecure default initialization8.7CNA v4.00.5%2026-04-20Fix
CVE-2026-32964silex technology SD-330AC CRLF injection6.9CNA v4.00.5%2026-04-20Fix
CVE-2026-32963silex technology SD-330AC cross-site scripting5.1CNA v4.00.3%2026-04-20Fix
CVE-2026-32962silex technology SD-330AC missing authentication6.9CNA v4.00.5%2026-04-20Fix
CVE-2026-32961silex technology SD-330AC heap-based buffer overflow6.9CNA v4.00.6%2026-04-20Fix
CVE-2026-32960silex technology SD-330AC sensitive information not cleared before reuse7.1CNA v4.00.5%2026-04-20Fix
CVE-2026-32959silex technology SD-330AC weak cryptographic algorithm8.2CNA v4.00.3%2026-04-20Fix
CVE-2026-32958silex technology SD-330AC hard-coded cryptographic key6.9CNA v4.00.4%2026-04-20Fix
CVE-2026-32957silex technology SD-330AC missing authentication6.9CNA v4.00.5%2026-04-20Fix
CVE-2026-32956silex technology SD-330AC heap-based buffer overflow9.3CNA v4.00.7%2026-04-20Fix
CVE-2026-32955silex technology SD-330AC stack-based buffer overflow8.7CNA v4.00.7%2026-04-20Fix
CVE-2026-32613Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling10.0CNA v3.10.7%2026-04-20Fix
CVE-2026-32604Spinnaker vulnerable to RCE when10.0CNA v3.10.8%2026-04-20Exploit codeFix
CVE-2026-32311reconurge flowsint command injection and Docker container escape allows root on host machine9.3CNA v4.00.7%2026-04-20
CVE-2026-32135NanoMQ has heap buffer overflow in URI Parameter Parsing7.7CNA v4.00.9%2026-04-20Fix
CVE-2026-31430Linux kernel X.509 certificate extension parser out-of-bounds read7.1v3.10.1%2026-04-20Fix
CVE-2026-31429Linux kernel SKB head allocation cache memory leak5.5v3.10.3%2026-04-20Fix
CVE-2026-30269doorman improper access control9.9CISA ADP v3.10.4%2026-04-20
CVE-2026-30266DeepCool Deepcreative insecure permissions7.8CISA ADP v3.10.2%2026-04-20
CVE-2026-29649Xiangshan Nemu denial of service9.8CISA ADP v3.10.7%2026-04-20
CVE-2026-29648OpenXiangShan NEMU Smstateen ENVCFG state control improper privilege management8.8CISA ADP v3.10.5%2026-04-20
CVE-2026-29647OpenXiangShan NEMU Smstateen IMSIC access control improper privilege management6.5CISA ADP v3.10.4%2026-04-20
CVE-2026-29646OpenXiangShan NEMU interrupt-enable CSR virtualization vulnerability9.8CISA ADP v3.10.7%2026-04-20
CVE-2026-29645Xiangshan Nemu improper type validation7.5CISA ADP v3.10.7%2026-04-20
CVE-2026-29643XiangShan NewCSR exception handling denial of service7.1CISA ADP v3.10.2%2026-04-20
CVE-2026-29642XiangShan menvcfg CSR handling vulnerability7.8CISA ADP v3.10.1%2026-04-20
CVE-2026-28684python-dotenv set_key function symlink following6.6CNA v3.10.2%2026-04-20Fix
CVE-2026-26951Dell PowerProtect Data Domain stack-based buffer overflow6.7CNA v3.10.2%2026-04-20Fix
CVE-2026-26944Dell PowerProtect Data Domain missing authentication8.8CNA v3.10.8%2026-04-20Fix
CVE-2026-26943Dell PowerProtect Data Domain OS command injection7.2CNA v3.12.0%2026-04-20Fix
CVE-2026-26942Dell PowerProtect Data Domain OS command injection6.7CNA v3.11.4%2026-04-20Fix
CVE-2026-26399Arduino Core STM32 pwm_start function vulnerability5.3CISA ADP v3.10.1%2026-04-20
CVE-2026-25883Vexa Webhook feature has a SSRF5.8CNA v3.10.3%2026-04-20Fix
CVE-2026-25525OpenMage LTS has path traversal Filter Bypass in Dataflow module4.9CNA v3.10.7%2026-04-20Fix
CVE-2026-25524OpenMage LTS's Phar deserialization leads to remote code execution8.1CNA v3.10.7%2026-04-20Fix
CVE-2026-25058Vexa's unauthenticated internal transcript endpoint exposed by default7.5CNA v3.10.4%2026-04-20Fix
CVE-2026-24506Dell PowerProtect Data Domain OS command injection7.2CNA v3.11.2%2026-04-20Fix
CVE-2026-24505Dell PowerProtect Data Domain improper input validation7.2CNA v3.10.4%2026-04-20Fix
CVE-2026-24504Dell PowerProtect Data Domain improper input validation7.2CNA v3.10.4%2026-04-20Fix
CVE-2026-24468OpenAEV password reset endpoint information disclosure5.3CNA v3.10.3%2026-04-20Fix
CVE-2026-24467Filigran OpenAEV password reset token weak password recovery9.1CNA v3.10.9%2026-04-20Fix
CVE-2026-23774Dell PowerProtect Data Domain OS command injection7.2CNA v3.11.5%2026-04-20Fix
CVE-2026-23758GFI HelpDesk stored XSS via editsubject parameter5.4v3.10.2%2026-04-20Fix
CVE-2026-23757GFI HelpDesk stored XSS via Reports module5.1CNA v4.00.1%2026-04-20Fix
CVE-2026-23756GFI HelpDesk stored XSS via Troubleshooter Step Subject5.1CNA v4.00.1%2026-04-20Fix
CVE-2026-23753GFI HelpDesk stored XSS via charset parameter4.8CNA v4.00.2%2026-04-20Fix
CVE-2026-23752GFI HelpDesk stored XSS via companyname parameter4.8CNA v4.00.2%2026-04-20Fix
CVE-2026-22761Dell PowerProtect Data Domain OS command injection6.7CNA v3.11.2%2026-04-20Fix
CVE-2026-22051NetApp StorageGRID information disclosure2.3CNA v4.00.2%2026-04-20Fix
CVE-2026-6729HKUDS OpenHarness Session Key Collision privilege escalation7.6v3.10.3%2026-04-20
CVE-2026-6662ericc-ch copilot-api Token endpoint server.ts cors cross-domain policy6.9CNA v4.00.3%2026-04-20
CVE-2026-6654Mozilla thin-vec use-after-free and double free in IntoIter::drop when element drop panics5.1NVD v3.10.2%2026-04-20Fix
CVE-2026-6652Pagekit CMS StringStorage Template PhpEngine.php evaluate eval injection5.1CNA v4.00.4%2026-04-20
CVE-2026-6651erponline.xyz ERP Online Inventory Edit Item cross-site scripting4.8CNA v4.00.4%2026-04-20
CVE-2026-6650Z-BlogPHP ZBA file app_upload.php UnPack unrestricted upload5.1CNA v4.00.4%2026-04-20
CVE-2026-6649Qibo CMS headers server-side request forgery5.3CNA v4.00.3%2026-04-20
CVE-2026-6648Qibo CMS Internal message cross-site scripting5.1CNA v4.00.3%2026-04-20
CVE-2026-6644A command injection vulnerability was found in the PPTP VPN Clients on the ADM9.1v3.12.1%2026-04-20
CVE-2026-6643A stack-based buffer overflow vulnerability in the VPN Clients on the ADM9.9v3.10.8%2026-04-20Exploit codeFix
CVE-2026-6636p2r3 convert API buildCache.js Bun.serve path traversal5.3CNA v4.00.5%2026-04-20
CVE-2026-6635rowboatlabs rowboat tools_webhook app.py tool_call improper authentication6.9CNA v4.00.7%2026-04-20
CVE-2026-6634usememos UpdateInstanceSetting App.tsx memos_access_token improper authorization5.3CNA v4.00.3%2026-04-20
CVE-2026-6633YiFang CMS Extended Management L_rbac_admin.php store cross-site scripting5.1CNA v4.00.3%2026-04-20
CVE-2026-6632Tenda F451 httpd SafeClientFilter fromSafeClientFilter buffer overflow8.7CNA v4.00.8%2026-04-20
CVE-2026-6631Tenda F451 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflow8.7CNA v4.00.8%2026-04-20
CVE-2026-6630Tenda F451 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow8.7CNA v4.00.8%2026-04-20
CVE-2026-6629Metasoft 美特软件 MetaCRM interface sql.jsp Statement.executeUpdate SQL injection6.9CNA v4.00.4%2026-04-20
CVE-2026-6628phili67 Ecclesia CRM Query Viewer view ValidateInput SQL injection5.3CNA v4.00.3%2026-04-20
CVE-2026-6626Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection5.3CNA v4.00.4%2026-04-20Fix
CVE-2026-6625moxi624 Mogu Blog picture storage service server-side request forgery6.9CNA v4.00.5%2026-04-20
CVE-2026-6624BichitroGan ISP Billing Software Pool List add cross-site scripting4.8CNA v4.00.4%2026-04-20
CVE-2026-6623BichitroGan ISP Billing Software Profile users-view cross-site scripting4.8CNA v4.00.4%2026-04-20
CVE-2026-6622BichitroGan ISP Billing Software customer edit handler cross-site scripting4.8CNA v4.00.4%2026-04-20
CVE-2026-66211024bit extend-deep index.js prototype pollution6.9CNA v4.00.6%2026-04-20
CVE-2026-6620SonicCloudOrg sonic-server file upload Endpoint FileTool.java upload path traversal5.3CNA v4.00.5%2026-04-20
CVE-2026-6619langgenius dify ImagePreview image-preview.tsx openInNewTab cross-site scripting5.1CNA v4.00.3%2026-04-20
CVE-2026-6618langgenius Dify ApiBasedToolSchemaParser server-side request forgery5.3CNA v4.00.3%2026-04-20
CVE-2026-6617langgenius Dify ApiToolManageService server-side request forgery5.3CNA v4.00.3%2026-04-20
CVE-2026-6616TransformerOptimus SuperAGI WebScraperTool server-side request forgery5.3CNA v4.00.4%2026-04-20
CVE-2026-6615TransformerOptimus SuperAGI Multipart upload resources.py upload path traversal6.9CNA v4.00.7%2026-04-20
CVE-2026-6614TransformerOptimus SuperAGI project.py get_projects_organisation authorization5.3CNA v4.00.4%2026-04-20
CVE-2026-6613TransformerOptimus SuperAGI agent.py get_schedule_data authorization5.3CNA v4.00.4%2026-04-20
CVE-2026-6612TransformerOptimus SuperAGI Agent Execution Endpoint authorization bypass5.3CNA v4.00.4%2026-04-20
CVE-2026-6611liangliangyy DjangoBlog file upload endpoint settings.py hard-coded key2.3CNA v4.00.4%2026-04-20
CVE-2026-6610liangliangyy DjangoBlog setting settings.py hard-coded credentials6.3CNA v4.00.4%2026-04-20
CVE-2026-6609liangliangyy DjangoBlog views.py form_valid improper authorization5.3CNA v4.00.3%2026-04-20
CVE-2026-6608lm-sys fastchat Arena Side-by-Side view add_text control flow6.9CNA v4.00.5%2026-04-20
CVE-2026-6607lm-sys fastchat Worker API endpoint api_generate resource consumption6.9CNA v4.00.7%2026-04-20
CVE-2026-6606modelscope agentscope _agent_base.py _process_audio_block server-side request forgery6.9CNA v4.00.5%2026-04-20
CVE-2026-6605AgentScope vulnerable to server-side request forgery6.9CNA v4.00.5%2026-04-20
CVE-2026-6604AgentScope vulnerable to server-side request forgery6.9CNA v4.00.5%2026-04-20
CVE-2026-6603modelscope agentscope _python.py execute_shell_command code injection6.9CNA v4.00.5%2026-04-20
CVE-2026-6602rickxy Hospital Management System his_admin_account.php unrestricted upload6.9CNA v4.00.5%2026-04-20
CVE-2026-6601Lagom WHMCS Template Datatables resource consumption5.3CNA v4.00.5%2026-04-20
CVE-2026-6600langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross-site scripting5.1CNA v4.00.3%2026-04-20
CVE-2026-6599Langflow vulnerable to injection5.3CNA v4.00.4%2026-04-20
CVE-2026-6598Langflow: Cleartext storage of Authentication settings in Project Creation endpoint5.3CNA v4.00.2%2026-04-20Fix
CVE-2026-6597langflow-ai langflow Flow Using API core.py has_api_terms credentials storage5.1CNA v4.00.4%2026-04-20
CVE-2026-6596langflow-ai langflow API endpoint endpoints.py create_upload_file unrestricted upload6.9CNA v4.00.5%2026-04-20Fix
CVE-2026-6595ProjectsAndPrograms School Management System HTTP GET parameter buslocation.php SQL injection6.9CNA v4.00.4%2026-04-20
CVE-2026-6594brikcss merge prototype pollution6.9CNA v4.00.6%2026-04-20
CVE-2026-6593ComfyUI view endpoint server.py cross-site scripting5.1CNA v4.00.3%2026-04-20